From patchwork Tue Sep 1 15:48:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296095 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=tPk9WGHn; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=W3OWbGua; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9Kj58Pqz1xwZ for ; Wed, 02 Sep 2026 01:50:01 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id CDA43607C0; Tue, 1 Sep 2026 15:49:59 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id kaQeUZ6w14gp; Tue, 1 Sep 2026 15:49:58 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277790; bh=Qti2fm/0fGHRxaIIiqPQb3AoKcid58/6ZudZVmuAXdM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=tPk9WGHnnLXHxoJrDmp+dV863NwShlwfVsiiHg/jPhpyMcOeBVavL5OH2ApNxSrLl w6ISOY0WqZ8CU2R6nWo8K7EdQ96C/yeEk94MfpO9dszQGVk0rt7xRxLOaZNZTbJ5XA GtIUYhM7OhIzHnlceO5dIrRSHtSs/VmI/GEbwb7qdphCpMt9cuCivJPMBbiD4JpE4v fRKV2B/Cmpo00TvPi0aVvZfdz/2tltLRO9j4ROYSfstHXipP1Ccg1RfxupiuPus6EL JA6zhpS2XVmo88Ps8zJdbriT9TCHNyLegP5hJjWXzx0vhiI5lt4UQ0LBbFBeEizwP7 h2MlBysY2tD5w== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id 7AE0D607A5; Tue, 1 Sep 2026 15:49:50 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists1.osuosl.org (Postfix) with ESMTP id 27683279 for ; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 1022D607A7 for ; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id y8-hiDZaOBMH for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp3.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=W3OWbGua Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) by smtp3.osuosl.org (Postfix) with ESMTPS id 4A57560786 for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id A535D841F2; Tue, 1 Sep 2026 17:49:26 +0200 (CEST) Received: from PAUP264CU001.outbound.protection.outlook.com (mail-francecentralazlp170110002.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E295084949 for ; Tue, 1 Sep 2026 17:48:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="W3OWbGua"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sdCApKi9Z5kt8S+zVA4I34bL+jm/RL3eB4ea4Cg+pMn0vI1pe6w2DGSfmP0BobYXq+YCX0Ih7cYTUV4ONdEYCRcfr9dj0B2r7Xv4+dU2jlTp4jSef6JlOMwstdbnOzQ5z2ykFMpXd0ifyh44y6vf7be5hwuGjTpc4+eYjLvISwSNSL34/cXB2BKz9AusNCutIMssTJsK6YaRR4Kv4ryJ9RFsFM1465oV2sWa0GOwQJaUpSvoGyqvWjlPOEN3Y4rvJKgdiCCSKP19q5XRarmWYG/IM7oGdwo/jfXcWJ8hD5aXdoJgjJA4tGJ63F8ozmTlKSQMP4LH8ckuPeOFSM8+PQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Qti2fm/0fGHRxaIIiqPQb3AoKcid58/6ZudZVmuAXdM=; b=W5hPsYBgoJisfPOos3gnAzqFqJz3vImfApEtsOBC0GTgQvkmqchBwPpCHT4k39JwYJLlsV7HZ8qfyE49iU+0o0dCtthasCpZCZQkWnQ6bmSV8atjKf2b6FFvJPyxCRXBVlFeSMXOv3pj+Ju3Fo+Y0lTEktaQ4tvKVYVYPocGK4/oySZBqdqSaU6GoXRwDk8bc3ZVhkDce6mJkCbzuzNUaWuhAgseNbrLD6bJpIcPjBiiwBWjB1GhQPB2AOq8HFnOwLqOBoRdssiqZPfa2j/3El+uUcJqR4dRz1p3muzG9rUWfpkp4wvVJdv5x32DiWpmyrCttGZX98sEMkZfi73Jkg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Qti2fm/0fGHRxaIIiqPQb3AoKcid58/6ZudZVmuAXdM=; b=W3OWbGuaD/wjAJPDXZY3/U6ccEN+TV5sSfuX2OtqbZdco3I4DPMFcXcskZ+W6LkEWg/sUbMqXZxYROd95jRUFh8EgokStgkcSfr5/OrJxfuPCsZNJMA98SrQXYCA12tx778sufFGp7OdbMxR8EWAz0AoE93V00kwW7eoi7NPx+4JwD4cHpcU7Hf5rrOwubpti/woDh8+XBxig45oTQpu75z/8U3jKWcIu3fpK9YVuz4kuQKj7FQHACYp7mjSrsMh+r/E6Ki751DBY11POO66wrfd/vib9nWyHf0klWjjnU/OdeDoEQShxiXMo9Lu333huQNvaypb1EXunsSQY1hnPg== Received: from MR1P264CA0202.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:57::19) by PARP264MB5673.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:4c1::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:52 +0000 Received: from MR1PEPF00000D5A.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:57:cafe::1d) by MR1P264CA0202.outlook.office365.com (2603:10a6:501:57::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by MR1PEPF00000D5A.mail.protection.outlook.com (10.167.241.7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 200492000D; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes Subject: [PATCH v9 01/15] ecdsa: fix support of secp521r1 Date: Tue, 1 Sep 2026 17:48:30 +0200 Message-ID: <20260901154845.102123-2-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MR1PEPF00000D5A:EE_|PARP264MB5673:EE_ X-MS-Office365-Filtering-Correlation-Id: 73bb7d5c-b30b-4403-1599-08df084085bb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|376014|23010399003|82310400026|36860700016|56012099006|10067099003|6133799003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: eDZnI37ho1w8kpivZ+/HPruwZrkdaLlRNtiR+5kvfD+dYZtjB9LkP2bA+2VkuQMudUJ6IK1GAB/XMixrNHa2UxVqTPC3OjYy93GJn3oamptMOoh0kaI3+JHia9XS2nbkz73UJ0XxvkZpmVzqmxvbmMarRYlXwTajHIaC6sme/jCvAfvu1DPv4N51x2IuPrT4kF5w99NeL4XPZFwnMW1XnAsaYtBEsBj1E1cP7Xp7d0uqbIZqOl+NGbd/k7+XeRBE4WvEnjI7SJ5PeJ+ckJik75KooUXfHnuI/LqMu5Y1YHxIe9bJhz3W5EobGtYDiVIfN27cQ+qP3LfERLymeTvDRiGSMBQpyGzYd+xnLdISh4zS52xUuyrpcmYGJazXpl+jUzR80MH33BNg4L/pfkSQJSqiLkwG4NQa4Sd2aWFcLrZQo3vDKv2rHz4ffbf5FVTisfBw4TUjTxY9KFDITDJflwuA9qTjqCIJakE/t0rdCnFachKE9ZWN2qu0XjxzTVVpbSLVeTzcpJXaRLy7lT3EhhUMuOdvnJr0ND4NLVbxhf1oDDRbRrJikJD56Zd/18SLT09LW8kDxMwJAeKshLptmqEVmXzeb2G7Sw2YjVMq1C2QxOgA1yjIES+kT7hXVn6w5DW7ugpCQ3Hsw9Mkdx/NlSR4HyZJMWRlAxNo42PUikJQIav2GekNvRbxQ25OM1DwuBkFMl6OSYRwaywUaVKUtA== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(376014)(23010399003)(82310400026)(36860700016)(56012099006)(10067099003)(6133799003)(22082099003)(18002099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: teskW5iU+dKr1/MJBqpkJZDCQIFxMixmFZS1Yfaxvi8BqmZHp6757VR8s4BoLSl52d2c+7fXBF1+qNGCUbbvqLk5XAgWsbNO+eOlPua5xNwU8/fzDRhWHzzUAInNLQgYz8VuF/2hohP68jQRHXGuWxD4Qd6Tu08V7tgj//t9SdeRALDv884NklWkReKbA+l206yuUlWfQ9DO4I+FZmizCiRs4CZwx9TRUM+8EoIJ78WGz74cpq/XK8fWme7piIqANmhX6jeYVQk9mUw59UeTB55bOOWaVKvF+c60VVRQ5BT0ezy6jKN2/FAAzA4Yn1sM5b4/9BhALJe7+GzS6zrn2Ji1GDkVIf8YpbLVDu8Zs2TCUabbokJOfgkYZtim0trAs9w+u97rG1lxaDT8hBHnB3650QgfY8M/taPjeTP8fOEROCANiNxhIH7Wu287KdIk X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.3775 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 73bb7d5c-b30b-4403-1599-08df084085bb X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: MR1PEPF00000D5A.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PARP264MB5673 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Current implementation of ecdsa only supports key len aligned on 8 bits. But the curve secp521r1 uses a key of 521 bits which is not aligned on 8 bits. In this commit, we update the keys management for ecdsa to support keys that are not aligned on 8 bits. Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v2: - intitial version v3: - fix typo in comments v4: - fix commit message - clean code with DIV_ROUND_UP- - duplicate data before shifting - support ecdsa521 and secp521r1 - clean code v5: - check that x and y are not null before using them - free keys when keys not found -v6: - free x and y if x and y are not null - do not free key when an error has occured v7: - no change v8: - check the exact size read in the dtb instead of doing a simple test on the expected size - change memdup api to use the same as in the header include/linux/string.h - code cleanup v9: - no change lib/ecdsa/ecdsa-libcrypto.c | 75 ++++++++++++++++++++++++++++++++++++- lib/ecdsa/ecdsa-verify.c | 71 +++++++++++++++++++++++++++++++++-- lib/fdt-libcrypto.c | 2 +- tools/image-sig-host.c | 7 ++++ 4 files changed, 148 insertions(+), 7 deletions(-) diff --git a/lib/ecdsa/ecdsa-libcrypto.c b/lib/ecdsa/ecdsa-libcrypto.c index c4bfb2cec61..b3fc75fac48 100644 --- a/lib/ecdsa/ecdsa-libcrypto.c +++ b/lib/ecdsa/ecdsa-libcrypto.c @@ -26,6 +26,8 @@ #include #include +#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) + /* Image signing context for openssl-libcrypto */ struct signer { EVP_PKEY *evp_key; /* Pointer to EVP_PKEY object */ @@ -41,10 +43,36 @@ struct ecdsa_public_key { int size_bits; }; +/* + * This function returns a valid pointer so + * the caller must then free this pointer. + */ +static char *memdup(const void *src, size_t len) +{ + char *p; + + p = malloc(len); + if (!p) + return NULL; + + memcpy(p, src, len); + + return p; +} + +/* + * This function fills keys with valid pointers (x and y) so + * the caller must then free those pointers with fdt_free_key(). + */ static int fdt_get_key(struct ecdsa_public_key *key, const void *fdt, int node) { + const char *x; + const char *y; int x_len; int y_len; + int expected_len; + + memset(key, 0, sizeof(*key)); key->curve_name = fdt_getprop(fdt, node, "ecdsa,curve", NULL); if (!key->curve_name) @@ -54,6 +82,8 @@ static int fdt_get_key(struct ecdsa_public_key *key, const void *fdt, int node) key->size_bits = 256; else if (!strcmp(key->curve_name, "secp384r1")) key->size_bits = 384; + else if (!strcmp(key->curve_name, "secp521r1")) + key->size_bits = 521; else return -EINVAL; @@ -63,12 +93,45 @@ static int fdt_get_key(struct ecdsa_public_key *key, const void *fdt, int node) if (!key->x || !key->y) return -EINVAL; - if (x_len != key->size_bits / 8 || y_len != key->size_bits / 8) + /* + * The public key is stored as an array of u32, so if the key size is + * not a multiple of 32 (for example 521), we may have extra bytes. + * To avoid any issue later, we shift the x and y pointer to the first + * useful byte. + */ + expected_len = DIV_ROUND_UP(key->size_bits, 8); + + if (x_len < expected_len || y_len < expected_len) return -EINVAL; + x = memdup(key->x + (x_len - expected_len), expected_len); + if (!x) { + fprintf(stderr, "Cannot allocate memory for point X"); + return -ENOMEM; + } + key->x = (const uint8_t *)x; + + y = memdup(key->y + (y_len - expected_len), expected_len); + if (!y) { + fprintf(stderr, "Cannot allocate memory for point Y"); + free((char *)x); + return -ENOMEM; + } + key->y = (const uint8_t *)y; + return 0; } +static void fdt_free_key(struct ecdsa_public_key *key) +{ + if (!key) + return; + if (key->x) + free((char *)key->x); + if (key->y) + free((char *)key->y); +} + static int read_key_from_fdt(struct signer *ctx, const void *fdt, int node) { struct ecdsa_public_key pubkey; @@ -89,8 +152,11 @@ static int read_key_from_fdt(struct signer *ctx, const void *fdt, int node) nid = NID_X9_62_prime256v1; } else if (!strcmp(pubkey.curve_name, "secp384r1")) { nid = NID_secp384r1; + } else if (!strcmp(pubkey.curve_name, "secp521r1")) { + nid = NID_secp521r1; } else { fprintf(stderr, "Unsupported curve name: '%s'\n", pubkey.curve_name); + fdt_free_key(&pubkey); return -EINVAL; } @@ -100,6 +166,7 @@ static int read_key_from_fdt(struct signer *ctx, const void *fdt, int node) ec_key = EC_KEY_new_by_curve_name(nid); if (!ec_key) { fprintf(stderr, "Failed to allocate EC_KEY for curve %s\n", pubkey.curve_name); + fdt_free_key(&pubkey); return -ENOMEM; } @@ -108,10 +175,11 @@ static int read_key_from_fdt(struct signer *ctx, const void *fdt, int node) if (!point) { fprintf(stderr, "Failed to allocate EC_POINT\n"); EC_KEY_free(ec_key); + fdt_free_key(&pubkey); return -ENOMEM; } - len = pubkey.size_bits / 8; + len = DIV_ROUND_UP(pubkey.size_bits, 8); uint8_t buf[1 + len * 2]; @@ -123,6 +191,7 @@ static int read_key_from_fdt(struct signer *ctx, const void *fdt, int node) fprintf(stderr, "Failed to convert (x,y) point to EC_POINT\n"); EC_POINT_free(point); EC_KEY_free(ec_key); + fdt_free_key(&pubkey); return -EINVAL; } @@ -130,11 +199,13 @@ static int read_key_from_fdt(struct signer *ctx, const void *fdt, int node) fprintf(stderr, "Failed to set EC_POINT as public key\n"); EC_POINT_free(point); EC_KEY_free(ec_key); + fdt_free_key(&pubkey); return -EINVAL; } fprintf(stderr, "Successfully loaded ECDSA key from FDT node %d\n", node); EC_POINT_free(point); + fdt_free_key(&pubkey); ctx->ecdsa_key = ec_key; return 0; diff --git a/lib/ecdsa/ecdsa-verify.c b/lib/ecdsa/ecdsa-verify.c index 629b662cf6c..494b60b4ab0 100644 --- a/lib/ecdsa/ecdsa-verify.c +++ b/lib/ecdsa/ecdsa-verify.c @@ -10,6 +10,7 @@ #include #include +#include #include /* @@ -24,13 +25,23 @@ static int ecdsa_key_size(const char *curve_name) return 256; else if (!strcmp(curve_name, "secp384r1")) return 384; + else if (!strcmp(curve_name, "secp521r1")) + return 521; return 0; } +/* + * This function fills keys with valid pointers (x and y) so + * the caller must then free those pointers with fdt_free_key(). + */ static int fdt_get_key(struct ecdsa_public_key *key, const void *fdt, int node) { - int x_len, y_len; + int expected_read, expected_len, x_len, y_len; + const char *x; + const char *y; + + memset(key, 0, sizeof(*key)); key->curve_name = fdt_getprop(fdt, node, "ecdsa,curve", NULL); if (!key->curve_name) { @@ -50,15 +61,50 @@ static int fdt_get_key(struct ecdsa_public_key *key, const void *fdt, int node) if (!key->x || !key->y) return -EINVAL; - if (x_len != (key->size_bits / 8) || y_len != (key->size_bits / 8)) { + expected_read = DIV_ROUND_UP(key->size_bits, 32) * 4; + if (x_len != expected_read || y_len != expected_read) { printf("%s: node=%d, curve@%p x@%p+%i y@%p+%i\n", __func__, node, key->curve_name, key->x, x_len, key->y, y_len); return -EINVAL; } + /* + * The public key is stored as an array of u32, so if the key size is + * not a multiple of 32 (for example 521), we may have extra bytes. + * To avoid any issue later, we shift the x and y pointer to the first + * useful byte. + */ + expected_len = DIV_ROUND_UP(key->size_bits, 8); + + x = memdup(key->x + (x_len - expected_len), expected_len); + if (!x) { + debug("Cannot allocate memory for point X\n"); + return -ENOMEM; + } + key->x = (const uint8_t *)x; + + y = memdup(key->y + (y_len - expected_len), expected_len); + if (!y) { + debug("Cannot allocate memory for point Y\n"); + free((char *)x); + key->x = NULL; + return -ENOMEM; + } + key->y = (const uint8_t *)y; + return 0; } +static void fdt_free_key(struct ecdsa_public_key *key) +{ + if (!key) + return; + if (key->x) + free((char *)key->x); + if (key->y) + free((char *)key->y); +} + static int ecdsa_verify_hash(struct udevice *dev, const struct image_sign_info *info, const void *hash, const void *sig, uint sig_len) @@ -76,8 +122,11 @@ static int ecdsa_verify_hash(struct udevice *dev, if (ret < 0) return ret; - return ops->verify(dev, &key, hash, algo->checksum_len, - sig, sig_len); + ret = ops->verify(dev, &key, hash, algo->checksum_len, + sig, sig_len); + fdt_free_key(&key); + + return ret; } sig_node = fdt_subnode_offset(info->fdt_blob, 0, FIT_SIG_NODENAME); @@ -93,6 +142,8 @@ static int ecdsa_verify_hash(struct udevice *dev, ret = ops->verify(dev, &key, hash, algo->checksum_len, sig, sig_len); + fdt_free_key(&key); + /* On success, don't worry about remaining keys */ if (!ret) return 0; @@ -135,6 +186,18 @@ U_BOOT_CRYPTO_ALGO(ecdsa384) = { .verify = ecdsa_verify, }; +U_BOOT_CRYPTO_ALGO(ecdsa521) = { + .name = "ecdsa521", + .key_len = ECDSA521_BYTES, + .verify = ecdsa_verify, +}; + +U_BOOT_CRYPTO_ALGO(secp521r1) = { + .name = "secp521r1", + .key_len = ECDSA521_BYTES, + .verify = ecdsa_verify, +}; + /* * uclass definition for ECDSA API * diff --git a/lib/fdt-libcrypto.c b/lib/fdt-libcrypto.c index ecb0344c8f6..090246b44e9 100644 --- a/lib/fdt-libcrypto.c +++ b/lib/fdt-libcrypto.c @@ -10,7 +10,7 @@ int fdt_add_bignum(void *blob, int noffset, const char *prop_name, BIGNUM *num, int num_bits) { - int nwords = num_bits / 32; + int nwords = (num_bits + 31) / 32; int size; uint32_t *buf, *ptr; BIGNUM *tmp, *big2, *big32, *big2_32; diff --git a/tools/image-sig-host.c b/tools/image-sig-host.c index 5285263c616..285547994ca 100644 --- a/tools/image-sig-host.c +++ b/tools/image-sig-host.c @@ -83,6 +83,13 @@ struct crypto_algo crypto_algos[] = { .add_verify_data = ecdsa_add_verify_data, .verify = ecdsa_verify, }, + { + .name = "ecdsa521", + .key_len = ECDSA521_BYTES, + .sign = ecdsa_sign, + .add_verify_data = ecdsa_add_verify_data, + .verify = ecdsa_verify, + }, { .name = "secp521r1", .key_len = ECDSA521_BYTES, From patchwork Tue Sep 1 15:48:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296092 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=juWYPjK3; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=pAKPPHGF; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9Kb6dsbz1xwZ for ; Wed, 02 Sep 2026 01:49:55 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 8169B6083A; Tue, 1 Sep 2026 15:49:54 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id xJ-wrJV1kQ_o; Tue, 1 Sep 2026 15:49:51 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277786; bh=MPvnH8uyVFgbLHxyDjKaVzWxzFSWR2oGoH3Lp7X5zoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=juWYPjK3m4xGgz8Vai7L5vfSJ+H7mmoNqB1g0Gfi9KjLXoYG5DC/OwpNba/BLMPSn pM7TU9Gb6qe6aSs121iS+5pl4Ty6UnEi8qysK/tsE11vJISMSVIeBTF1VnU2nBxw7V BOw6HlGc5sdHWJ3QzYY9xOQRGdClhg8WaNaYbN2PVpttPRG7dLZdwUICDTGlM2WxAo p8r3Zg2L/0yNpZgxQGlT3qJJKGMWtiwgjc8bwHuCEmyydwoLnjGzdcovmn1mmPgpsG tPzclxR01c2DhzdyOlWK7U/BM86pV/QVlqr8ZEf9ZjZBfXT9IT9ogzxW7JTBNNyHeD vIBDP0zMkzO+A== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id BD6A3607E2; Tue, 1 Sep 2026 15:49:46 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists1.osuosl.org (Postfix) with ESMTP id 53C2F279 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 399C7400C1 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id OHaay7VsBxKQ for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=pAKPPHGF Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) by smtp2.osuosl.org (Postfix) with ESMTPS id 64A25401ED for ; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id CE91E8424C; Tue, 1 Sep 2026 17:49:26 +0200 (CEST) Received: from PAUP264CU001.outbound.protection.outlook.com (mail-francecentralazlp170110002.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E6908849EB for ; Tue, 1 Sep 2026 17:48:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="pAKPPHGF"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yF1pSor20ibD71xV8xe132h48woRtS8xyint755wrn6I2tuaIuOzbOJ+MZMs4PEmIajYiMchjV/ZeyQO9XX1N4bbeecwblv8D9Q8Gve8IQolCy73MvpUaDTmE23VrAIy4/49dOQHQA90yCqGI7LGNqxURqvZk60LdHgTFV0QEJeAh/+FqRxwCgQEiX70wNjyjHFXeYeDGUNNdlm7mrPUo7EJS8iqIduOaB/ONC2xrgWWUnKurbWHfXenGqVh52vYteinU/wWxDetxFb4GI7gnlG01uUNjLBvAu/zC8pEcQKu2PRTZh7WwwA7XAFIU0En2XTLLfC9bCxkW18ldzJ7zA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MPvnH8uyVFgbLHxyDjKaVzWxzFSWR2oGoH3Lp7X5zoQ=; b=seAY8fc747XnHq79Be6Qkd17wh3Tfl6+aI13hfPdxLfhSsrdC6bu2a0Rn8FvfkcUppnNKdZpm5OyAHK0hRbkcfqEbG5tYqExkvxLRCogIHt5fhiM2vbT44v0OI5BUpkLLpZ3MY6+tP/xB4mK+kgWZamsU8c9BnAPTNg7ZwvjjAYM5ZJz09fenoYXd5vT9kfOlYBIAQbWnYLRkVAWe2OyX0UM31Dv/gltNwRwjvEyv55+Pkv0rfJSkiXp2JKwBIUQ5wrZmS3RLEXNVuTE6N+3DgQRG5K4e1NZaRzsy1XNNVmuUbnKINe0TrG9xHVxD/+qjym7eA+basgriwTWiM+mmg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MPvnH8uyVFgbLHxyDjKaVzWxzFSWR2oGoH3Lp7X5zoQ=; b=pAKPPHGFRBhrWc+x6vtWqIjaxjXzPJtTSVT1yrOWKX0WkOAQ5boBBNFUYXiZjQvpKcFenB9g5+osFt1AF8oaeWA0wEOZG2jGsBKrMJaNrlAqVVWTSZxkS0q/3GQ7Z0A8498gMyi3udzDVXGL2JCoS47S0dNQKhVyK6rn4JfMMQuMDaPCt1bQKGSxJ4E/fu+TTTrrDugDoVTLkm8P7hXk9X8D9zJUE1LvAf9Ly3iLk6wzI5fuOpnt1YJjVJVOU/BjShh8GBkGiXz4IL+KUwMl7BWaFulwVPeY64Tv8Ehekd90NFeNflDotpWMU2f+U8FYYzdvAYhzCvs3qzBW8eLwlg== Received: from PR1P264CA0099.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2cf::6) by PR0P264MB2390.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1e1::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:52 +0000 Received: from PA3PEPF000089B8.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2cf:cafe::2) by PR1P264CA0099.outlook.office365.com (2603:10a6:102:2cf::6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.10 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA3PEPF000089B8.mail.protection.outlook.com (10.167.242.20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 3A9762024F; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes Subject: [PATCH v9 02/15] mbedtls: enable support of ecc Date: Tue, 1 Sep 2026 17:48:31 +0200 Message-ID: <20260901154845.102123-3-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA3PEPF000089B8:EE_|PR0P264MB2390:EE_ X-MS-Office365-Filtering-Correlation-Id: 657105e8-d1c4-45ed-e2da-08df084085bc X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|376014|23010399003|36860700016|82310400026|1800799024|10067099003|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: LcKd/HiDcc86ASDJ3scqlE60rkncJZMgKXyMCnRzrQop9kbuiUO/GIvBRIxMOpMN9ig2XRmODzp3pHmpKSjyP7SCjbsnLdE1aRVW6esAS3Q1uXmuBPKFi8E3mjZx3vYxL2laHu6Lz6rvWFOP+US9Ukkk+2OCufwpnaHaXF/O7gK2rJE2m8bWAaWeQLd/z5eqHes3vJLDVxALJ58oR1h+H/qFGeloXrwN57vOAPfum+DBk4YS5IPmANEWO2m9Szy4HUOgQ9chRie0SzpKzR7BonC0tAKNlT/lpAsteGmvHw5T86bGGfTpgnPv+i9SlEQ/xMw5293cF/D8FSd1HfxFiEoROaN0Bxbm2idANPP7DI8AMRKJEIMjyWO8xex/wi3xGFEzxVvvhvHTp8/+9RsRKsohS8N6IPOy/8Bbezqa9arj4wr7DtQXk78jt7J6CEbry1z4LnZbx4VtAMYtzYK88Ca2H+7nb2dlTs0Z+oewTGtkSWwZvbgCerxhDgQgfenwp+Gy7nUTVJwZLhUSCxF4FuN52zuCM3aDR2wM7mvyDRn3mRCmfmdbHq670c5RqN4QvY0j4j16F9FnhCJmGFau6rFe/oyJGG8xV2j52Rz5z8Ng9IMkyqO8I3+XS2GhqyP5LP5jvOJEhNSoxjOVH61Wb/sNM+WdmEWRV3gES+gJo5UoeZxL5vkaT5Blhe6HlPvj/wE13EfCccbICwW9yYXvsg== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(376014)(23010399003)(36860700016)(82310400026)(1800799024)(10067099003)(56012099006)(18002099003)(22082099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Bs9SkzNMTTVfe5MUSvi+Ne1BFLNw45MDQfccgZQi3GleOYvtHs3pJoBEFYM5V6dlp5Au93/7GkkUcbG5eLxwJdQYP3Lh8HvZu4sBSBJBzm6PqGvJyXYh5ITbnR0Ezl5Ylspx9xyPu010DE6gYHTJ6DlquwnjCKZFC5MDfd/evBRNc/BCbDDWG9iQGmpxk8nXZl3w/cikIfYTP90sZNurCOEPVm3rYQqJ7As18heaAtdwOV29S2LRR0YI7qT30GxRFCeJGH1SgbhasXWB+bmbM6wKB3xAebJmzuSHMy8steX/fRomxnwef6xPmZSgKN/91Qecy5rzS55V1XgduzBXFkodqNokgW+Jhp4w/7gSEhiVwFhazOaLUVG4EErQhHgkPuSNAlKBn1IGnGeTUj8/z19n28QOXTZKhdt3whs0h41iimBXLo9l2EIq43ivm8vm X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.4095 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 657105e8-d1c4-45ed-e2da-08df084085bc X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA3PEPF000089B8.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR0P264MB2390 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Prepares the support of ecdsa signature check using MbedTLS. It introduces the option ECDSA_MBEDTLS to enable (or not) the support of ecdsa in MbedTLS. So now, ecdsa is no longer supported by default in the lib TLS. To get it, the option ECDSA_MBEDTLS must be enabled. The option ECDSA_MBEDTLS only enables the ecdsa support in MbedTLS, it doesn't provide any API to use it for signature check. It will be done in another commit by adding the option ECDSA_VERIFY_MBEDTLS. Two internal options are also added BIGNUM_MBEDTLS and ECC_MBEDTLS. Those options are used to share code between different option and avoid duplication. Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v2: - move ecdsa to MBEDTLS_LIB_X509 - enhance depencendies v3: - do not use _MBEDTLS in mbedtls_def_config.h v4: - do not select ECDSA on some configs - remove duplicated MBEDTLS_ECP_DP_SECP256K1_ENABLED - change dependencies for ECDSA configs v5: - MBEDTLS_LIB_TLS depends en ECDSA_MBEDTLS - update some configs according to previous change - build of ecdsa is conditionned by ECDSA_MBEDTLS v6: - fix dependencies for ecdsa and ecc on mbedtls - ecdsa is no longer mandatory for tls v7: - no change v8: - enhance the commit message - use /* */ instead of // v9: - no change configs/sandbox_defconfig | 1 + lib/ecdsa/Kconfig | 1 + lib/mbedtls/Kconfig | 17 +++++++++++++ lib/mbedtls/Makefile | 17 +++++++------ lib/mbedtls/mbedtls_def_config.h | 41 +++++++++++++++++++++----------- 5 files changed, 56 insertions(+), 21 deletions(-) diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig index 5c97418783f..b9991d269d9 100644 --- a/configs/sandbox_defconfig +++ b/configs/sandbox_defconfig @@ -389,6 +389,7 @@ CONFIG_PMBUS=y CONFIG_CMD_DHRYSTONE=y CONFIG_MBEDTLS_LIB=y CONFIG_HKDF_MBEDTLS=y +CONFIG_ECDSA_MBEDTLS=y CONFIG_ECDSA=y CONFIG_ECDSA_VERIFY=y CONFIG_RSASSA_PSS=y diff --git a/lib/ecdsa/Kconfig b/lib/ecdsa/Kconfig index ca13b6bfa1f..dac8bcf23dd 100644 --- a/lib/ecdsa/Kconfig +++ b/lib/ecdsa/Kconfig @@ -1,6 +1,7 @@ config ECDSA bool "Enable ECDSA support" depends on DM + select ASN1_DECODER help This enables the ECDSA (elliptic curve signature) algorithm for FIT image verification in U-Boot. The ECDSA algorithm is implemented diff --git a/lib/mbedtls/Kconfig b/lib/mbedtls/Kconfig index 789721ee6cd..e019f17d6bd 100644 --- a/lib/mbedtls/Kconfig +++ b/lib/mbedtls/Kconfig @@ -247,6 +247,12 @@ config MBEDTLS_LIB_X509 if MBEDTLS_LIB_X509 +config BIGNUM_MBEDTLS + bool + +config ECC_MBEDTLS + bool + config ASN1_DECODER_MBEDTLS bool "ASN1 decoder with MbedTLS certificate library" depends on MBEDTLS_LIB_X509 && ASN1_DECODER @@ -264,6 +270,7 @@ config RSA_PUBLIC_KEY_PARSER_MBEDTLS bool "RSA public key parser with MbedTLS certificate library" depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS select ASN1_DECODER_MBEDTLS + select BIGNUM_MBEDTLS help This option chooses MbedTLS certificate library for RSA public key parser. @@ -292,6 +299,15 @@ config MSCODE_PARSER_MBEDTLS This option chooses MbedTLS certificate library for MS authenticode parser. +config ECDSA_MBEDTLS + bool "Enable ECDSA support with MbedTLS certificate library" + depends on MBEDTLS_LIB_X509 && ASN1_DECODER_MBEDTLS + select BIGNUM_MBEDTLS + select ECC_MBEDTLS + help + This option enables support of ECDSA with the MbedTLS certificate + library. + endif # MBEDTLS_LIB_X509 config MBEDTLS_LIB_TLS @@ -301,6 +317,7 @@ config MBEDTLS_LIB_TLS depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS depends on ASN1_DECODER_MBEDTLS depends on MBEDTLS_LIB + select ECC_MBEDTLS help Enable MbedTLS TLS library. Required for HTTPs support in wget diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile index c5b445bd85c..0c86c90d15a 100644 --- a/lib/mbedtls/Makefile +++ b/lib/mbedtls/Makefile @@ -39,13 +39,21 @@ mbedtls_lib_crypto-$(CONFIG_$(PHASE_)HKDF_MBEDTLS) += \ # MbedTLS X509 library obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_X509) += mbedtls_lib_x509.o mbedtls_lib_x509-y := $(MBEDTLS_LIB_DIR)/x509.o +mbedtls_lib_x509-$(CONFIG_$(PHASE_)ECC_MBEDTLS) += \ + $(MBEDTLS_LIB_DIR)/ecp.o \ + $(MBEDTLS_LIB_DIR)/ecp_curves.o \ + $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \ + $(MBEDTLS_LIB_DIR)/pk_ecc.o +mbedtls_lib_x509-$(CONFIG_$(PHASE_)ECDSA_MBEDTLS) += \ + $(MBEDTLS_LIB_DIR)/ecdsa.o +mbedtls_lib_x509-$(CONFIG_$(PHASE_)BIGNUM_MBEDTLS) += \ + $(MBEDTLS_LIB_DIR)/bignum.o \ + $(MBEDTLS_LIB_DIR)/bignum_core.o mbedtls_lib_x509-$(CONFIG_$(PHASE_)ASN1_DECODER_MBEDTLS) += \ $(MBEDTLS_LIB_DIR)/asn1parse.o \ $(MBEDTLS_LIB_DIR)/asn1write.o \ $(MBEDTLS_LIB_DIR)/oid.o mbedtls_lib_x509-$(CONFIG_$(PHASE_)RSA_PUBLIC_KEY_PARSER_MBEDTLS) += \ - $(MBEDTLS_LIB_DIR)/bignum.o \ - $(MBEDTLS_LIB_DIR)/bignum_core.o \ $(MBEDTLS_LIB_DIR)/rsa.o \ $(MBEDTLS_LIB_DIR)/rsa_alt_helpers.o mbedtls_lib_x509-$(CONFIG_$(PHASE_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \ @@ -64,7 +72,6 @@ mbedtls_lib_tls-y := \ $(MBEDTLS_LIB_DIR)/mps_reader.o \ $(MBEDTLS_LIB_DIR)/mps_trace.o \ $(MBEDTLS_LIB_DIR)/net_sockets.o \ - $(MBEDTLS_LIB_DIR)/pk_ecc.o \ $(MBEDTLS_LIB_DIR)/ssl_cache.o \ $(MBEDTLS_LIB_DIR)/ssl_ciphersuites.o \ $(MBEDTLS_LIB_DIR)/ssl_client.o \ @@ -82,8 +89,4 @@ mbedtls_lib_tls-y := \ $(MBEDTLS_LIB_DIR)/cipher.o \ $(MBEDTLS_LIB_DIR)/cipher_wrap.o \ $(MBEDTLS_LIB_DIR)/ecdh.o \ - $(MBEDTLS_LIB_DIR)/ecdsa.o \ - $(MBEDTLS_LIB_DIR)/ecp.o \ - $(MBEDTLS_LIB_DIR)/ecp_curves.o \ - $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \ $(MBEDTLS_LIB_DIR)/gcm.o \ diff --git a/lib/mbedtls/mbedtls_def_config.h b/lib/mbedtls/mbedtls_def_config.h index dda3f4dd6e4..d55f31acfda 100644 --- a/lib/mbedtls/mbedtls_def_config.h +++ b/lib/mbedtls/mbedtls_def_config.h @@ -62,6 +62,25 @@ #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) +#if CONFIG_IS_ENABLED(BIGNUM_MBEDTLS) +#define MBEDTLS_BIGNUM_C +#endif + +#if CONFIG_IS_ENABLED(ECC_MBEDTLS) +#define MBEDTLS_ECP_C +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +#endif + #if CONFIG_IS_ENABLED(X509_CERTIFICATE_PARSER) #define MBEDTLS_X509_USE_C #define MBEDTLS_X509_CRT_PARSE_C @@ -74,7 +93,6 @@ #endif #if CONFIG_IS_ENABLED(RSA_PUBLIC_KEY_PARSER) -#define MBEDTLS_BIGNUM_C #define MBEDTLS_RSA_C #define MBEDTLS_PKCS1_V15 #endif @@ -89,6 +107,10 @@ #define MBEDTLS_ASN1_WRITE_C #endif +#if CONFIG_IS_ENABLED(ECDSA_MBEDTLS) +#define MBEDTLS_ECDSA_C +#endif + #endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */ #if CONFIG_IS_ENABLED(MBEDTLS_LIB_TLS) @@ -122,7 +144,9 @@ /* ECDSA */ #if CONFIG_IS_ENABLED(ASN1_DECODER) +#if CONFIG_IS_ENABLED(ECDSA_MBEDTLS) #define MBEDTLS_ECDSA_C +#endif /* #if CONFIG_IS_ENABLED(ECDSA_MBEDTLS) */ #define MBEDTLS_ECP_C #define MBEDTLS_ECDH_C #endif @@ -130,24 +154,13 @@ #define MBEDTLS_HMAC_DRBG_C #define MBEDTLS_CAN_ECDH +#if CONFIG_IS_ENABLED(ECDSA_MBEDTLS) #define MBEDTLS_PK_CAN_ECDSA_SIGN #if CONFIG_IS_ENABLED(X509_CERTIFICATE_PARSER) #define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED #define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED #endif - -#define MBEDTLS_ECP_DP_SECP256K1_ENABLED -#define MBEDTLS_ECP_DP_SECP192R1_ENABLED -#define MBEDTLS_ECP_DP_SECP224R1_ENABLED -#define MBEDTLS_ECP_DP_SECP256R1_ENABLED -#define MBEDTLS_ECP_DP_SECP384R1_ENABLED -#define MBEDTLS_ECP_DP_SECP521R1_ENABLED -#define MBEDTLS_ECP_DP_SECP192K1_ENABLED -#define MBEDTLS_ECP_DP_SECP224K1_ENABLED -#define MBEDTLS_ECP_DP_SECP256K1_ENABLED -#define MBEDTLS_ECP_DP_BP256R1_ENABLED -#define MBEDTLS_ECP_DP_BP384R1_ENABLED -#define MBEDTLS_ECP_DP_BP512R1_ENABLED +#endif /* #if CONFIG_IS_ENABLED(ECDSA_MBEDTLS) */ #endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_TLS) */ From patchwork Tue Sep 1 15:48:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296093 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=vkWfQ+59; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=DxJsw7Vu; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9Kf14n5z1xwZ for ; Wed, 02 Sep 2026 01:49:58 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id C44F780E16; Tue, 1 Sep 2026 15:49:56 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 5v5SuaSlRyoq; Tue, 1 Sep 2026 15:49:55 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277795; bh=e1sHt4newV07NBuB4os4tXQZqNfM/vrpw/xyq9U/7rQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=vkWfQ+59pl0259x/hR+GLRoVQwNcDS/b4OwgTDo1wO4T4ekzuKeImWiXKF8DSW/0W QmVja9BtNlkEf6KpnpmFn4y0PMirQvsIYWE9Ulz3qb/cVZLXAK2paGN0lyGAioqsuF xtvcx+EcR0gWwOacWkUsSGbgm60hdkjOJJp4tWM4FuFD9lUv7Y5jIu38AUwQix1hgH j5fPkBgtkevBFzbQssTTP6xEZUg3qssz1R8cWMIRBUZIyC4do3PlU9GpLaZscdl2NP CnDne4S/7QSZUXeASgvI2s5cIaFs+kX7e0FghlJMEaaTCeqHbLWM0oJz2Tlwd8xkoY v0E037kVbxLGA== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id A71B880E2C; Tue, 1 Sep 2026 15:49:55 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists1.osuosl.org (Postfix) with ESMTP id EF14B422 for ; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id E13CA4070F for ; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id p8vfp-rKgzEj for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp4.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp4.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=DxJsw7Vu Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp4.osuosl.org (Postfix) with ESMTPS id 0579E4071B for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 529C0840D8; Tue, 1 Sep 2026 17:49:29 +0200 (CEST) Received: from PA5P264CU001.outbound.protection.outlook.com (mail-francecentralazlp170100000.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id DD85484659 for ; Tue, 1 Sep 2026 17:48:58 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="DxJsw7Vu"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=H4bf2rd7kIOQSYSgmjFnC2hjr8BpPZQg0QjYWZGFZ1dOld4zrT1qPOQ6iONQFvj4Yvf3F32VgGFXYlfaEmN2muqgzTxqyEf/0AvDxA4LTZ0j7QdcB86jq/sX9+jtB0ehzK4vGShs1AUj08HK9Z4T42cRgzxVCRKXhyik3K1138HbfqpVzfHW46vDqEVFHp3qbCWjFF8UhiUkaZwJ1FT18HYKxQH40TerdnulXawOtY8LGgtyvD+031MseNOqZZidQo7HbfnjCeC55XQWCBS2L/zGELM8xpOhlD1Jyjbfp6NySxHu5rfeNHXaxbsqlBlN9wLDntNTbFVY5ErEt6hdcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=e1sHt4newV07NBuB4os4tXQZqNfM/vrpw/xyq9U/7rQ=; b=pdlfNag97YKpfEDW+MVSX/HHEHuDtkheTmB2Sp8dgHLf2ChTeeqwNlw8ZGfP/xFpq2X3BPGuSKeBtB4kJJDWDNs1MOdY6nZfPBF2LlQoV/vpXCglqYfDF0RXzOhLwLwvAjI8prUYk13FZsMtSdWX0LBlsddtIdQOas/u9SvbiFRM1zaYPaFvez4hD9hFWCsXuVr/9LXLAvPKSRshXy07Oxj5bi1pd5ahLPdFBSKE9DmRPHTqmUo9XHXJ684UNjOIUnkVk9ApmuI4Rtv+OiBmTdjEtWDNP6TXhSxxsqUWtoBewe3K6iEvllpTSB0eWAeIpCkmzYpgyR7J0IJEd+Womg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=e1sHt4newV07NBuB4os4tXQZqNfM/vrpw/xyq9U/7rQ=; b=DxJsw7VuJK0CWHo/jk+Lz/R3MlAjVGtPHBO64vmO88Va78aK1tUUT2LKV3tbqMALkHAYo161+6/fb5bNXdWlwvXDZ/Kzkgnvpqp5cfa3NPmBKgdKib4S4AOr9t625A9xBbIt5nPuhd5NaGuJfifLw3zL+0jmcvB4XUnhjB8IQfj9vjPFPyLPBJnu2ghWSD7kbmb2G8ZgxHfsTPdpn7WE6D3lFRYzTehagQQPxU2Hjr95zFnI2N1+b+RJECCOjtUtULQnsUxp+ZrOBxqe4bgh4SjZcJBAH2uXdxZaPrCC4jhAY9uXESPMasXvvYthRc469XzfCkyAtataREe/ALO+FA== Received: from DB8PR06CA0043.eurprd06.prod.outlook.com (2603:10a6:10:120::17) by PATP264MB4552.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:42b::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA1PEPF000CC3FB.FRAP264.PROD.OUTLOOK.COM (2603:10a6:10:120:cafe::a7) by DB8PR06CA0043.outlook.office365.com (2603:10a6:10:120::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA1PEPF000CC3FB.mail.protection.outlook.com (10.167.242.6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 54A0D202B3; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes Subject: [PATCH v9 03/15] ecdsa: initial support of ecdsa using mbedtls Date: Tue, 1 Sep 2026 17:48:32 +0200 Message-ID: <20260901154845.102123-4-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA1PEPF000CC3FB:EE_|PATP264MB4552:EE_ X-MS-Office365-Filtering-Correlation-Id: 3fe85a5b-d5c5-4862-8931-08df084085c4 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|82310400026|36860700016|1800799024|23010399003|376014|22082099003|18002099003|56012099006|10067099003; X-Microsoft-Antispam-Message-Info: 2R/iC49fBUmnY6w3qV4mxmLATaRVVRdPZNTex/w1QZxD1XNP2FnKKnM+BhuHd2Uj3++NhR/fPItO2Zoqod2GKmoWpQVtYbDpD35xblBc2BMh4rFnR/JC/1OxyWUWNeyNEBtaiwcuOcU3Db9kNjhg8azAahcokJm4jUrQf54XnmFLMddmx/dmCqnXK28uCUNOnXS8z6yyDw7vi1aT6IDbMwChmcbm8O1vulAf5mLYfu2RRukA/PeCQVKvFpP6w3+9bAR6gAchpV9JCAJvxTPNC7WTsp52g40EUeCsydbisAQlEiS9KeqSPFg29o7SLrNLEuPyJhK8rqB77LDG/1CZLT1IiHQk3Yin66jWQuG9JHQ6IAwX71lg8jB2za1bkpEo0v4d0PbnBd+v8pJP1CCE0iYgnlKjOJ5FypUeatIw9qDd4uvVKG3e644WcvfVdePfphU14M029OSUp3N3RxJSyMe6/IvDQ4cJ+Ei0K7efNWOkHx2DMISGCThhXIer9Nhqo1W7mH9cix2QGUDp5s1XDLV05wQ/JVgT1naNA9JcH11HrxdQKkpfkyN07HPCHxfF4QsTeWiCyywymrumd1SB6r9NTBMdX1BOKrWJl53Kcgz9yC0qoo3sl4Yqpxgcl7aBmcS5pODc6+8U5d7dXq6i/dV2hHcF2VChv5Yu6zH3aVbI992rYAZJULW4y3b02YDWZJScJ6dtcKxlPZjXmpxxzw== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(82310400026)(36860700016)(1800799024)(23010399003)(376014)(22082099003)(18002099003)(56012099006)(10067099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: PMNl0oAEAdbBC0MlJVfopLs00R2TTT6rcTtFLgaWgJs5KzGUjasEtGoEBwFH16Ph5QLODLEuOCW1etZl3bgw8uHTBkjhgqovsd/FN+n7DXU6xTMUbPBeYuB0OnNEAo+CX4MAghECBkT2A18UQslB5dzvuGlhlJx+qxxvm2RKXeEpx8aceQC5vmRXrlBeRxIkIUb1RHlUMMWgg40yWZ0c8ooN24g6aPNzGaYacuZn+0KAvANFz3dHCOYJ2no+jB71HyJjdTLMUzytThYvnoTXtj4B28bjSd48LW3RX+2izzlFrMPNIxQ03Kn+Ry4mFeiTPz2UD1UP+rMPokzrvqxqBFyTCc3GOM46eq52PYL5D4agE2X0oCEgZMDZbs3X4DMM/Dw8WPsUeICpWztVGVCnoavPUGEjdRMUummXZX0UYPWx7H6tx/poCuff5CT/062F X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.4989 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 3fe85a5b-d5c5-4862-8931-08df084085c4 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA1PEPF000CC3FB.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PATP264MB4552 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Adds an initial support of ecdsa verify using mbedtls. Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v2: - rename sw_ecdsa.c to ecdsa.c v3: - rename sw_ecdsa_verify to ecdsa_hash_verify - stop on first group found - check signature len - use debug instead of printf - check function returns - fix memleaks in ecdsa_hash_verify v4: - move struct ecdsa_public_key from ecdsa-u-class.h to internal/ecdsa.h - use DIV_ROUND_UP - some code cleanup v5: - add kerneldoc header for ecdsa_hash_verify - read error when setting Q.Z v6: - add ECDSA_VERIFY_MBEDTLS - fix kerneldoc: doc not add a space before : v7: - no change v8: - add some useful comments - avoid using label such as out1, out2, out3 ... - code cleanup v9: - no change configs/sandbox_defconfig | 1 + include/crypto/ecdsa-uclass.h | 15 +--- include/crypto/internal/ecdsa.h | 39 ++++++++ lib/mbedtls/Kconfig | 7 ++ lib/mbedtls/Makefile | 3 + lib/mbedtls/ecdsa.c | 152 ++++++++++++++++++++++++++++++++ 6 files changed, 203 insertions(+), 14 deletions(-) create mode 100644 include/crypto/internal/ecdsa.h create mode 100644 lib/mbedtls/ecdsa.c diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig index b9991d269d9..63682ef0e74 100644 --- a/configs/sandbox_defconfig +++ b/configs/sandbox_defconfig @@ -390,6 +390,7 @@ CONFIG_CMD_DHRYSTONE=y CONFIG_MBEDTLS_LIB=y CONFIG_HKDF_MBEDTLS=y CONFIG_ECDSA_MBEDTLS=y +CONFIG_ECDSA_VERIFY_MBEDTLS=y CONFIG_ECDSA=y CONFIG_ECDSA_VERIFY=y CONFIG_RSASSA_PSS=y diff --git a/include/crypto/ecdsa-uclass.h b/include/crypto/ecdsa-uclass.h index 189843820a0..047a5eda2fc 100644 --- a/include/crypto/ecdsa-uclass.h +++ b/include/crypto/ecdsa-uclass.h @@ -4,20 +4,7 @@ */ #include - -/** - * struct ecdsa_public_key - ECDSA public key properties - * - * The struct has pointers to the (x, y) curve coordinates to an ECDSA public - * key, as well as the name of the ECDSA curve. The size of the key is inferred - * from the 'curve_name' - */ -struct ecdsa_public_key { - const char *curve_name; /* Name of curve, e.g. "prime256v1" */ - const void *x; /* x coordinate of public key */ - const void *y; /* y coordinate of public key */ - unsigned int size_bits; /* key size in bits, derived from curve name */ -}; +#include struct ecdsa_ops { /** diff --git a/include/crypto/internal/ecdsa.h b/include/crypto/internal/ecdsa.h new file mode 100644 index 00000000000..244a07d1f1f --- /dev/null +++ b/include/crypto/internal/ecdsa.h @@ -0,0 +1,39 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (c) 2026, Philippe Reynes + */ +#ifndef _ECDSA_HELPER_ +#define _ECDSA_HELPER_ + +#include + +/** + * struct ecdsa_public_key - ECDSA public key properties + * + * The struct has pointers to the (x, y) curve coordinates to an ECDSA public + * key, as well as the name of the ECDSA curve. The size of the key is inferred + * from the 'curve_name' + */ +struct ecdsa_public_key { + const char *curve_name; /* Name of curve, e.g. "prime256v1" */ + const void *x; /* x coordinate of public key */ + const void *y; /* y coordinate of public key */ + unsigned int size_bits; /* key size in bits, derived from curve name */ +}; + +/** + * ecdsa_hash_verify() - Verify the ecdsa signature of a hash + * + * @pubkey: ecdsa public key + * @hash: Hash + * @hash_len: Size of the hash + * @signature: Signature + * @sig_len: Size of the signature + * + * Return: 0 if all verified ok, <0 on error + */ +int ecdsa_hash_verify(const struct ecdsa_public_key *pubkey, + const void *hash, size_t hash_len, + const void *signature, size_t sig_len); + +#endif diff --git a/lib/mbedtls/Kconfig b/lib/mbedtls/Kconfig index e019f17d6bd..66bc16db451 100644 --- a/lib/mbedtls/Kconfig +++ b/lib/mbedtls/Kconfig @@ -308,6 +308,13 @@ config ECDSA_MBEDTLS This option enables support of ECDSA with the MbedTLS certificate library. +config ECDSA_VERIFY_MBEDTLS + bool "Enable ECDSA verify" + depends on ECDSA_MBEDTLS && ECDSA_VERIFY + help + This option enables support of ECDSA signature check with + MbedTLS certificate library. + endif # MBEDTLS_LIB_X509 config MBEDTLS_LIB_TLS diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile index 0c86c90d15a..b96db812afc 100644 --- a/lib/mbedtls/Makefile +++ b/lib/mbedtls/Makefile @@ -11,6 +11,9 @@ obj-$(CONFIG_$(PHASE_)SHA1_MBEDTLS) += sha1.o obj-$(CONFIG_$(PHASE_)SHA256_MBEDTLS) += sha256.o obj-$(CONFIG_$(PHASE_)SHA512_MBEDTLS) += sha512.o +# shim layer for ecdsa verify +obj-$(CONFIG_$(PHASE_)ECDSA_VERIFY_MBEDTLS) += ecdsa.o + # x509 libraries obj-$(CONFIG_$(PHASE_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \ public_key.o diff --git a/lib/mbedtls/ecdsa.c b/lib/mbedtls/ecdsa.c new file mode 100644 index 00000000000..ca4e572e638 --- /dev/null +++ b/lib/mbedtls/ecdsa.c @@ -0,0 +1,152 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2026 Philippe Reynes + */ + +#include +#include +#include +#include + +#include + +#include "mbedtls_options.h" /* required to access private fields */ +#include +#include + +static mbedtls_ecp_group_id ecdsa_search_group_id(const char *curve_name) +{ + mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE; + const mbedtls_ecp_curve_info *info; + + if (!curve_name) + return MBEDTLS_ECP_DP_NONE; + + /* + * This curve name is read in the FIT metadata. + * When this FIT metadata are filled by mkimage (or binman), + * the curve name is the alias/name provided by OpenSSL. + * And for secp256r1, OpenSSL uses the alias prime256v1. + * So here, we have to manage this OpenSSL alias. + */ + if (!strcmp(curve_name, "prime256v1")) + return MBEDTLS_ECP_DP_SECP256R1; + + info = mbedtls_ecp_curve_list(); + while (info && info->name) { + if (!strcmp(curve_name, info->name)) { + grp_id = info->grp_id; + break; + } + info++; + } + + return grp_id; +} + +int ecdsa_hash_verify(const struct ecdsa_public_key *pubkey, + const void *hash, size_t hash_len, + const void *signature, size_t sig_len) +{ + mbedtls_ecp_group_id grp_id; + mbedtls_ecp_group grp; + mbedtls_ecp_point Q; + mbedtls_mpi r, s; + int key_len; + int err; + + key_len = DIV_ROUND_UP(pubkey->size_bits, 8); + + /* check the signature len */ + if (sig_len != 2 * key_len) { + log_debug("sig len should be twice the key len (sig len = %zu, key len = %d)\n", + sig_len, key_len); + err = -EINVAL; + goto out; + } + + /* search the group */ + grp_id = ecdsa_search_group_id(pubkey->curve_name); + if (grp_id == MBEDTLS_ECP_DP_NONE) { + log_debug("curve name %s not found\n", pubkey->curve_name); + err = -EINVAL; + goto out; + } + + /* init and load the group */ + mbedtls_ecp_group_init(&grp); + err = mbedtls_ecp_group_load(&grp, grp_id); + if (err) { + err = -EINVAL; + goto free_grp; + } + + /* prepare the pubkey */ + mbedtls_ecp_point_init(&Q); + err = mbedtls_mpi_read_binary(&Q.X, pubkey->x, key_len); + if (err) { + log_debug("could not read value x of the public key (err = %d)\n", + err); + err = -EINVAL; + goto free_q; + } + err = mbedtls_mpi_read_binary(&Q.Y, pubkey->y, key_len); + if (err) { + log_debug("could not read value y of the public key (err = %d)\n", + err); + err = -EINVAL; + goto free_q; + } + err = mbedtls_mpi_lset(&Q.Z, 1); + if (err) { + log_debug("could not set value z of the public key (err = %d)\n", + err); + err = -EINVAL; + goto free_q; + } + + /* check if the pubkey is valid */ + err = mbedtls_ecp_check_pubkey(&grp, &Q); + if (err) { + log_debug("public key is invalid (err = %d)\n", err); + err = -EKEYREJECTED; + goto free_q; + } + + /* compute r */ + mbedtls_mpi_init(&r); + err = mbedtls_mpi_read_binary(&r, signature, key_len); + if (err) { + log_debug("could not read value r of the signature (err = %d)\n", + err); + err = -EINVAL; + goto free_r; + } + + /* compute s */ + mbedtls_mpi_init(&s); + err = mbedtls_mpi_read_binary(&s, signature + key_len, key_len); + if (err) { + log_debug("could not read value s of the signature (err = %d)\n", + err); + err = -EINVAL; + goto free_s; + } + + /* check the signature */ + err = mbedtls_ecdsa_verify(&grp, hash, hash_len, &Q, &r, &s); + if (err) + err = -EINVAL; + + free_s: + mbedtls_mpi_free(&s); + free_r: + mbedtls_mpi_free(&r); + free_q: + mbedtls_ecp_point_free(&Q); + free_grp: + mbedtls_ecp_group_free(&grp); + out: + + return err; +} From patchwork Tue Sep 1 15:48:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296088 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=WM9aU70O; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=qtIih4Do; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KR3GZpz1xwZ for ; Wed, 02 Sep 2026 01:49:47 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 1AB56607C9; Tue, 1 Sep 2026 15:49:46 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id wQsB1ZAhZi_Y; Tue, 1 Sep 2026 15:49:42 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277782; bh=1g18Ms8LkIO7wV3yspX1IIJRf0DSv2B3IRzXAJM6Bfc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=WM9aU70OhmZ29s9ykbEAaftOmy6cP+QjH0WAZI82oWaLEL+YpL6VPPhC+cL0iJuDs PrNBAKRmwLCBHq6E8uGGwYB/7yEeLJgTzbdHVaf+1zWbJ8DJieH9KG8TISsk0353Dt YRsgT08Vu+T1HUmOBtnqBwlQfRGYxrsOcyBWa+y5WusPUFYuCFIQEb58A6BjUiwzhq psafLBm00S6TaiEbtM5HERMAKJtAJ6ISRtDXu+8Oan2nmWmo7QlhAG7oc8ZzTRR+2z 6QRKPo0nByfPYXNFnvf6Y++U6vMA+9LGZnA6v6ek+c0gDyOG2FJSubQPXu5UK8Fju4 sTQ+3f7h3QVAw== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id E4EC3607E2; Tue, 1 Sep 2026 15:49:41 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138]) by lists1.osuosl.org (Postfix) with ESMTP id BA379E45 for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id ABDE980D73 for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id zOHeWfWsgp-P for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp1.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp1.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=qtIih4Do Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp1.osuosl.org (Postfix) with ESMTPS id 3CF8180972 for ; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 599998467F; Tue, 1 Sep 2026 17:49:23 +0200 (CEST) Received: from MRZP264CU002.outbound.protection.outlook.com (mail-francesouthazlp170100001.outbound.protection.outlook.com [IPv6:2a01:111:f403:c207::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id DE90C84671 for ; Tue, 1 Sep 2026 17:48:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="qtIih4Do"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=B2XsqfBZU9MdVz44uny1yY+OXcAuSL++jOQTBYs1Y4OeyvLLiShfxudpHPNfXPxhZ1pbwg3YawxvwSv9ws+71rugdDbRgHIAqWMuhQ4sjvceKy4wUf8e6hy1zsok2KcTIyBqId55K06qBycwKHL3w0g2lkkV/Lo3hLLJSBnLRAwYS8QLxoifRNUYgiTBlQKXIvZjlX0XcIGFpaZN0tRCxj0SPH7JfxVhww9lja5z3+NUMDz9FvErCwhsuC7jhVRF44QQgbcqnbZh8TESXoOFS3xF/O6E7se0RndeltDkTxszE/tP143bfpDzUu4wS7OanP3HcY/rn0n6R3ACTGwKhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1g18Ms8LkIO7wV3yspX1IIJRf0DSv2B3IRzXAJM6Bfc=; b=LCtE7myLn0Rp/DXngUh4KYsunkFkwuEpnUq6wzwUjvv9l9QX6pldibWibK+hfWPBPwfcxbaeViCWA6iZ6vy+glYsLIGnDhtVoV2Gp/wGCiGxwRWUNFFAkBlraVbe7FoYvdND7Rqhywa1K6R315ANoL4060TzcHJgysCjHeN0Wevy7F6skhY1a2xhjhb5jBDjhBPwC/+9Kq97eGXPj09KEBDMH//o0l9hYyDLclkR4AXYLirNdEj4u7qYrSCgCh3i/ttMJBEeLZv+l3sLoJm7mbxNUW/Zocz9n7jPbTPDLeb3qBbYB16GxuCgG0eHMuVI8lHoa0x1R85tSLN+E1U24Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1g18Ms8LkIO7wV3yspX1IIJRf0DSv2B3IRzXAJM6Bfc=; b=qtIih4DoEamyAqTgQtJX5UX3DOs2vvnWCljdSllgYpx+KjqJFmnfucDT41f8/3DqQXOXzJIuEdJoXwhHZxE3QyQ0vrysifIhU0Y0yOryZdwccXF0/bZgbr6vtstxmYA3lmfxjtxgaS2E0ZdB0ayCAoacO0iVvXAX4VQFDOZCB8dZ99gnh31XZsugcHgtK5nGbgGpDZJy0rcIj0JAdBcq6ad+/C+ip/TVsHyR7t//2ldClxsqanRRRJF65+yCt3DX1wRcXBfzI1E4Lj98bh9GhmKgM9qBphLG8d12BAP1rWOvUE/v0VXqGkjX8rmrLz2oyAYYMk7YCqtPdkIMeOolLg== Received: from PAZP264CA0109.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1ef::10) by PR0P264MB1690.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:16a::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:52 +0000 Received: from PA2PEPF00019232.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1ef:cafe::76) by PAZP264CA0109.outlook.office365.com (2603:10a6:102:1ef::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA2PEPF00019232.mail.protection.outlook.com (10.167.242.38) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 6D2B0202C1; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 04/15] test: lib: ecdsa: add initial test Date: Tue, 1 Sep 2026 17:48:33 +0200 Message-ID: <20260901154845.102123-5-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA2PEPF00019232:EE_|PR0P264MB1690:EE_ X-MS-Office365-Filtering-Correlation-Id: 2ebd5fe5-7aec-4040-feb5-08df084085d9 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|36860700016|376014|23010399003|1800799024|82310400026|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: 34yiSwvsJ3HqAMNkZAyyjE6sIq4qPTGsykw7ne1Agrs/Czijcdl5YE8rfh9XfXwPj6H4Mquf2w2NXeMNAgBp6CXT1COLgUavLK4mCfTz+LpN43eer6mSjmUhjtu4IYtI2ODJ1vPOQabs9S2Ih+tZIvw33/J+XyUh15tNFzSX3tfWIZg85zbeb8gR8D7LGDnicg/CD9d8qEvnQzdF7jlUZVV3/7zrfmtlf7na4KM/UXlcFjGJ+h+ZQjn/w/yiXguBdJAiBtpBVjHwEuMwg42L/dWpfXQ6f/6v0vMBnlcfbSIph56Puq8DXWCRyTHtjdlNeO38jCFcCXXrOO7FzWuFq1q/dUlr+OgGe5p8pigWvJVpjE5BMs/5VsEJcLVDiP5OsDWyipgbTGL2FNliSOohMPfiCM0sNhO6SXh96j6RfPmYORvVJCiRDU1kehQc2E9jVXWpCMHnAC/s9hpfhlFc1N1TSYg00LYaHVUStbA9r00UcEkcA8OevNPFybAWMRWPbBdrRV8ioc6NGF9Zr0zhVbdRt8rvNGrHQURheU8bNntyJy64k65AJhDmYPtStiq5W68ZPobSdYLIlwTEfUSRbryO/54chExSOc52CWJL5RvcnqhXJ9fQpuQgdGi7cNue7E7B2Cxb/BxzzfLKzE/ELmnPpLaXIyH6qryf0ye5QH2nqi2PANUTsB3qVAwmrbvokoLkc54IH1UkHa/0SNffKQ== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(36860700016)(376014)(23010399003)(1800799024)(82310400026)(10067099003)(56012099006)(22082099003)(18002099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: khKYqJ0MFpdOBAybHD7zEgo9sJuJhmRpClKl1pFFeUMGy7cMBuOvt8eJCqQNbd8HpaMCQsDrAd2uJXtdyQbP/UQadlANa2lMgTWEQmwxaM4hTBnLQ1Ub+3SC118+ULyncaA28idXSjYe8F1nWI5+M3tNwbLK9hA0vub91qNcwHjg5k2ZTIyeyRR4lJVD//l21HzSEyFmKkJ9Q912qEqrPSJN5N4deFbo3+DAq/J1Ree8UL9tnNC0dSc2k5ZKEouh5maLevSmEa7CX+8KUpidS+RKDVDtIx4bvHw2MsEw+VWleM4IBAI247mqkI8mjWC5JNZMhDrZLfkDjNjMwNmpVqia6gevCsfRSljFcp7Urhp7JF4PKP4sWXM5WbACcxvh7sUgMimvlOWEoQLKVwmZj2UN3i8f/PAzAzsSiRGdQF4jaZqJY4wj7Q7Xgp7hJ5/c X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.5991 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2ebd5fe5-7aec-4040-feb5-08df084085d9 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA2PEPF00019232.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR0P264MB1690 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Adds tests to check that the function ecdsa_hash_verify using mbedtls is valid. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v2: - little change to only use test with sha enabled v3: - remove useless field *k in struct ecdsa_test_vector_s - change expected value on error (don't use mbedtls error) - manage function returns - update third parameter of sha*_csum_wd v4: - define SHA256_DEF_CHUNK_SZ, SHA384_DEF_CHUNK_SZ and SHA512_DEF_CHUNK_SZ - report skipped tests - add const on some variables - code cleanup v5: - do not define SHA256_DEF_CHUNK_SZ, SHA384_DEF_CHUNK_SZ and SHA512_DEF_CHUNK_SZ - use CHUNKSZ_SHA256, CHUNKSZ_SHA384 and CHUNKSZ_SHA521 - do not use 528 to compule ecdsa 521 sig size but compute it - use ut_reportf instead of ut_failf v6: - no change v7: - no change v8: - no change v9: - no change test/lib/Makefile | 1 + test/lib/ecdsa.c | 456 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 457 insertions(+) create mode 100644 test/lib/ecdsa.c diff --git a/test/lib/Makefile b/test/lib/Makefile index f25383a40e5..e9c779a7b47 100644 --- a/test/lib/Makefile +++ b/test/lib/Makefile @@ -8,6 +8,7 @@ obj-$(CONFIG_$(PHASE_)UT_COMPRESSION) += compression.o ifeq ($(CONFIG_XPL_BUILD),) obj-y += abuf.o obj-y += alist.o +obj-$(CONFIG_ECDSA_VERIFY_MBEDTLS) += ecdsa.o obj-$(CONFIG_EFI_LOADER) += efi_device_path.o efi_memory.o obj-$(CONFIG_EFI_SECURE_BOOT) += efi_image_region.o ifdef CONFIG_RISCV diff --git a/test/lib/ecdsa.c b/test/lib/ecdsa.c new file mode 100644 index 00000000000..bc7737837e5 --- /dev/null +++ b/test/lib/ecdsa.c @@ -0,0 +1,456 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2026 Philippe Reynes + */ + +#include +#include +#include +#include +#include +#include +#include + +#define ECDSA_POINT_SIZE (DIV_ROUND_UP(521, 8) * 2) +#define ECDSA_SIGNATURE_SIZE (ECDSA_POINT_SIZE * 2) + +struct ecdsa_test_vector_s { + const char *test_name; + const char *curve_name; + const char *x; + const char *y; + int size_bits; + const char *hash_type; + const char *hash_message; + const char *r; + const char *s; + int expected; +}; + +/* + * Those data come from RFC6979 + */ + +static const struct ecdsa_test_vector_s ecdsa_test_vector[] = { + /* + * secp192r1 + */ + { + .test_name = "secp192r1 sha1", + .curve_name = "secp192r1", + .x = "AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56", + .y = "3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43", + .size_bits = 192, + .hash_type = "sha-1", + .hash_message = "sample", + .r = "98C6BD12B23EAF5E2A2045132086BE3EB8EBD62ABF6698FF", + .s = "57A22B07DEA9530F8DE9471B1DC6624472E8E2844BC25B64", + .expected = 0, + }, + { + .test_name = "secp192r1 sha256", + .curve_name = "secp192r1", + .x = "AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56", + .y = "3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43", + .size_bits = 192, + .hash_type = "sha-256", + .hash_message = "sample", + .r = "4B0B8CE98A92866A2820E20AA6B75B56382E0F9BFD5ECB55", + .s = "CCDB006926EA9565CBADC840829D8C384E06DE1F1E381B85", + .expected = 0, + }, + { + .test_name = "secp192r1 sha384", + .curve_name = "secp192r1", + .x = "AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56", + .y = "3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43", + .size_bits = 192, + .hash_type = "sha-384", + .hash_message = "sample", + .r = "DA63BF0B9ABCF948FBB1E9167F136145F7A20426DCC287D5", + .s = "C3AA2C960972BD7A2003A57E1C4C77F0578F8AE95E31EC5E", + .expected = 0, + }, + { + .test_name = "secp192r1 sha512", + .curve_name = "secp192r1", + .x = "AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56", + .y = "3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43", + .size_bits = 192, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "4D60C5AB1996BD848343B31C00850205E2EA6922DAC2E4B8", + .s = "3F6E837448F027A1BF4B34E796E32A811CBB4050908D8F67", + .expected = 0, + }, + { + .test_name = "secp192r1 sha512 error", + .curve_name = "secp192r1", + .x = "AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56", + .y = "3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43", + .size_bits = 192, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "4D60C5AB1996BD848343B31C00850205E2EA6922DAC2E4B8", + .s = "0F6E837448F027A1BF4B34E796E32A811CBB4050908D8F67", + .expected = -EINVAL, + }, + /* + * secp224r1 + */ + { + .test_name = "secp224r1 sha1", + .curve_name = "secp224r1", + .x = "00CF08DA5AD719E42707FA431292DEA11244D64FC51610D94B130D6C", + .y = "EEAB6F3DEBE455E3DBF85416F7030CBD94F34F2D6F232C69F3C1385A", + .size_bits = 224, + .hash_type = "sha-1", + .hash_message = "sample", + .r = "22226F9D40A96E19C4A301CE5B74B115303C0F3A4FD30FC257FB57AC", + .s = "66D1CDD83E3AF75605DD6E2FEFF196D30AA7ED7A2EDF7AF475403D69", + .expected = 0, + }, + { + .test_name = "secp224r1 sha256", + .curve_name = "secp224r1", + .x = "00CF08DA5AD719E42707FA431292DEA11244D64FC51610D94B130D6C", + .y = "EEAB6F3DEBE455E3DBF85416F7030CBD94F34F2D6F232C69F3C1385A", + .size_bits = 224, + .hash_type = "sha-256", + .hash_message = "sample", + .r = "61AA3DA010E8E8406C656BC477A7A7189895E7E840CDFE8FF42307BA", + .s = "BC814050DAB5D23770879494F9E0A680DC1AF7161991BDE692B10101", + .expected = 0, + }, + { + .test_name = "secp224r1 sha384", + .curve_name = "secp224r1", + .x = "00CF08DA5AD719E42707FA431292DEA11244D64FC51610D94B130D6C", + .y = "EEAB6F3DEBE455E3DBF85416F7030CBD94F34F2D6F232C69F3C1385A", + .size_bits = 224, + .hash_type = "sha-384", + .hash_message = "sample", + .r = "0B115E5E36F0F9EC81F1325A5952878D745E19D7BB3EABFABA77E953", + .s = "830F34CCDFE826CCFDC81EB4129772E20E122348A2BBD889A1B1AF1D", + .expected = 0, + }, + { + .test_name = "secp224r1 sha512", + .curve_name = "secp224r1", + .x = "00CF08DA5AD719E42707FA431292DEA11244D64FC51610D94B130D6C", + .y = "EEAB6F3DEBE455E3DBF85416F7030CBD94F34F2D6F232C69F3C1385A", + .size_bits = 224, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "074BD1D979D5F32BF958DDC61E4FB4872ADCAFEB2256497CDAC30397", + .s = "A4CECA196C3D5A1FF31027B33185DC8EE43F288B21AB342E5D8EB084", + .expected = 0, + }, + { + .test_name = "secp224r1 sha512 error", + .curve_name = "secp224r1", + .x = "00CF08DA5AD719E42707FA431292DEA11244D64FC51610D94B130D6C", + .y = "EEAB6F3DEBE455E3DBF85416F7030CBD94F34F2D6F232C69F3C1385A", + .size_bits = 224, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "074BD1D979D5F32BF958DDC61E4FB4872ADCAFEB2256497CDAC30397", + .s = "04CECA196C3D5A1FF31027B33185DC8EE43F288B21AB342E5D8EB084", + .expected = -EINVAL, + }, + /* + * secp256r1 + */ + { + .test_name = "secp256r1 sha1", + .curve_name = "secp256r1", + .x = "60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6", + .y = "7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299", + .size_bits = 256, + .hash_type = "sha-1", + .hash_message = "sample", + .r = "61340C88C3AAEBEB4F6D667F672CA9759A6CCAA9FA8811313039EE4A35471D32", + .s = "6D7F147DAC089441BB2E2FE8F7A3FA264B9C475098FDCF6E00D7C996E1B8B7EB", + .expected = 0, + }, + { + .test_name = "secp256r1 sha256", + .curve_name = "secp256r1", + .x = "60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6", + .y = "7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299", + .size_bits = 256, + .hash_type = "sha-256", + .hash_message = "sample", + .r = "EFD48B2AACB6A8FD1140DD9CD45E81D69D2C877B56AAF991C34D0EA84EAF3716", + .s = "F7CB1C942D657C41D436C7A1B6E29F65F3E900DBB9AFF4064DC4AB2F843ACDA8", + .expected = 0, + }, + { + .test_name = "secp256r1 sha384", + .curve_name = "secp256r1", + .x = "60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6", + .y = "7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299", + .size_bits = 256, + .hash_type = "sha-384", + .hash_message = "sample", + .r = "0EAFEA039B20E9B42309FB1D89E213057CBF973DC0CFC8F129EDDDC800EF7719", + .s = "4861F0491E6998B9455193E34E7B0D284DDD7149A74B95B9261F13ABDE940954", + .expected = 0, + }, + { + .test_name = "secp256r1 sha512", + .curve_name = "secp256r1", + .x = "60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6", + .y = "7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299", + .size_bits = 256, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "8496A60B5E9B47C825488827E0495B0E3FA109EC4568FD3F8D1097678EB97F00", + .s = "2362AB1ADBE2B8ADF9CB9EDAB740EA6049C028114F2460F96554F61FAE3302FE", + .expected = 0, + }, + { + .test_name = "secp256r1 sha512 error", + .curve_name = "secp256r1", + .x = "60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6", + .y = "7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299", + .size_bits = 256, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "8496A60B5E9B47C825488827E0495B0E3FA109EC4568FD3F8D1097678EB97F00", + .s = "0362AB1ADBE2B8ADF9CB9EDAB740EA6049C028114F2460F96554F61FAE3302FE", + .expected = -EINVAL, + }, + /* + * secp384r1 + */ + { + .test_name = "secp384r1 sha1", + .curve_name = "secp384r1", + .x = "EC3A4E415B4E19A4568618029F427FA5DA9A8BC4AE92E02E06AAE5286B300C64DEF8F0EA9055866064A254515480BC13", + .y = "8015D9B72D7D57244EA8EF9AC0C621896708A59367F9DFB9F54CA84B3F1C9DB1288B231C3AE0D4FE7344FD2533264720", + .size_bits = 384, + .hash_type = "sha-1", + .hash_message = "sample", + .r = "EC748D839243D6FBEF4FC5C4859A7DFFD7F3ABDDF72014540C16D73309834FA37B9BA002899F6FDA3A4A9386790D4EB2", + .s = "A3BCFA947BEEF4732BF247AC17F71676CB31A847B9FF0CBC9C9ED4C1A5B3FACF26F49CA031D4857570CCB5CA4424A443", + .expected = 0, + }, + { + .test_name = "secp384r1 sha256", + .curve_name = "secp384r1", + .x = "EC3A4E415B4E19A4568618029F427FA5DA9A8BC4AE92E02E06AAE5286B300C64DEF8F0EA9055866064A254515480BC13", + .y = "8015D9B72D7D57244EA8EF9AC0C621896708A59367F9DFB9F54CA84B3F1C9DB1288B231C3AE0D4FE7344FD2533264720", + .size_bits = 384, + .hash_type = "sha-256", + .hash_message = "sample", + .r = "21B13D1E013C7FA1392D03C5F99AF8B30C570C6F98D4EA8E354B63A21D3DAA33BDE1E888E63355D92FA2B3C36D8FB2CD", + .s = "F3AA443FB107745BF4BD77CB3891674632068A10CA67E3D45DB2266FA7D1FEEBEFDC63ECCD1AC42EC0CB8668A4FA0AB0", + .expected = 0, + }, + { + .test_name = "secp384r1 sha384", + .curve_name = "secp384r1", + .x = "EC3A4E415B4E19A4568618029F427FA5DA9A8BC4AE92E02E06AAE5286B300C64DEF8F0EA9055866064A254515480BC13", + .y = "8015D9B72D7D57244EA8EF9AC0C621896708A59367F9DFB9F54CA84B3F1C9DB1288B231C3AE0D4FE7344FD2533264720", + .size_bits = 384, + .hash_type = "sha-384", + .hash_message = "sample", + .r = "94EDBB92A5ECB8AAD4736E56C691916B3F88140666CE9FA73D64C4EA95AD133C81A648152E44ACF96E36DD1E80FABE46", + .s = "99EF4AEB15F178CEA1FE40DB2603138F130E740A19624526203B6351D0A3A94FA329C145786E679E7B82C71A38628AC8", + .expected = 0, + }, + { + .test_name = "secp384r1 sha512", + .curve_name = "secp384r1", + .x = "EC3A4E415B4E19A4568618029F427FA5DA9A8BC4AE92E02E06AAE5286B300C64DEF8F0EA9055866064A254515480BC13", + .y = "8015D9B72D7D57244EA8EF9AC0C621896708A59367F9DFB9F54CA84B3F1C9DB1288B231C3AE0D4FE7344FD2533264720", + .size_bits = 384, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "ED0959D5880AB2D869AE7F6C2915C6D60F96507F9CB3E047C0046861DA4A799CFE30F35CC900056D7C99CD7882433709", + .s = "512C8CCEEE3890A84058CE1E22DBC2198F42323CE8ACA9135329F03C068E5112DC7CC3EF3446DEFCEB01A45C2667FDD5", + .expected = 0, + }, + { + .test_name = "secp384r1 sha512 error", + .curve_name = "secp384r1", + .x = "EC3A4E415B4E19A4568618029F427FA5DA9A8BC4AE92E02E06AAE5286B300C64DEF8F0EA9055866064A254515480BC13", + .y = "8015D9B72D7D57244EA8EF9AC0C621896708A59367F9DFB9F54CA84B3F1C9DB1288B231C3AE0D4FE7344FD2533264720", + .size_bits = 384, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "ED0959D5880AB2D869AE7F6C2915C6D60F96507F9CB3E047C0046861DA4A799CFE30F35CC900056D7C99CD7882433709", + .s = "012C8CCEEE3890A84058CE1E22DBC2198F42323CE8ACA9135329F03C068E5112DC7CC3EF3446DEFCEB01A45C2667FDD5", + .expected = -EINVAL, + }, + /* + * secp521r1 + */ + { + .test_name = "secp521r1 sha1", + .curve_name = "secp521r1", + .x = "01894550D0785932E00EAA23B694F213F8C3121F86DC97A04E5A7167DB4E5BCD371123D46E45DB6B5D5370A7F20FB633155D38FFA16D2BD761DCAC474B9A2F5023A4", + .y = "00493101C962CD4D2FDDF782285E64584139C2F91B47F87FF82354D6630F746A28A0DB25741B5B34A828008B22ACC23F924FAAFBD4D33F81EA66956DFEAA2BFDFCF5", + .size_bits = 521, + .hash_type = "sha-1", + .hash_message = "sample", + .r = "00343B6EC45728975EA5CBA6659BBB6062A5FF89EEA58BE3C80B619F322C87910FE092F7D45BB0F8EEE01ED3F20BABEC079D202AE677B243AB40B5431D497C55D75D", + .s = "00E7B0E675A9B24413D448B8CC119D2BF7B2D2DF032741C096634D6D65D0DBE3D5694625FB9E8104D3B842C1B0E2D0B98BEA19341E8676AEF66AE4EBA3D5475D5D16", + .expected = 0, + }, + { + .test_name = "secp521r1 sha256", + .curve_name = "secp521r1", + .x = "01894550D0785932E00EAA23B694F213F8C3121F86DC97A04E5A7167DB4E5BCD371123D46E45DB6B5D5370A7F20FB633155D38FFA16D2BD761DCAC474B9A2F5023A4", + .y = "00493101C962CD4D2FDDF782285E64584139C2F91B47F87FF82354D6630F746A28A0DB25741B5B34A828008B22ACC23F924FAAFBD4D33F81EA66956DFEAA2BFDFCF5", + .size_bits = 521, + .hash_type = "sha-256", + .hash_message = "sample", + .r = "01511BB4D675114FE266FC4372B87682BAECC01D3CC62CF2303C92B3526012659D16876E25C7C1E57648F23B73564D67F61C6F14D527D54972810421E7D87589E1A7", + .s = "004A171143A83163D6DF460AAF61522695F207A58B95C0644D87E52AA1A347916E4F7A72930B1BC06DBE22CE3F58264AFD23704CBB63B29B931F7DE6C9D949A7ECFC", + .expected = 0, + }, + { + .test_name = "secp521r1 sha384", + .curve_name = "secp521r1", + .x = "01894550D0785932E00EAA23B694F213F8C3121F86DC97A04E5A7167DB4E5BCD371123D46E45DB6B5D5370A7F20FB633155D38FFA16D2BD761DCAC474B9A2F5023A4", + .y = "00493101C962CD4D2FDDF782285E64584139C2F91B47F87FF82354D6630F746A28A0DB25741B5B34A828008B22ACC23F924FAAFBD4D33F81EA66956DFEAA2BFDFCF5", + .size_bits = 521, + .hash_type = "sha-384", + .hash_message = "sample", + .r = "01EA842A0E17D2DE4F92C15315C63DDF72685C18195C2BB95E572B9C5136CA4B4B576AD712A52BE9730627D16054BA40CC0B8D3FF035B12AE75168397F5D50C67451", + .s = "01F21A3CEE066E1961025FB048BD5FE2B7924D0CD797BABE0A83B66F1E35EEAF5FDE143FA85DC394A7DEE766523393784484BDF3E00114A1C857CDE1AA203DB65D61", + .expected = 0, + }, + { + .test_name = "secp521r1 sha512", + .curve_name = "secp521r1", + .x = "01894550D0785932E00EAA23B694F213F8C3121F86DC97A04E5A7167DB4E5BCD371123D46E45DB6B5D5370A7F20FB633155D38FFA16D2BD761DCAC474B9A2F5023A4", + .y = "00493101C962CD4D2FDDF782285E64584139C2F91B47F87FF82354D6630F746A28A0DB25741B5B34A828008B22ACC23F924FAAFBD4D33F81EA66956DFEAA2BFDFCF5", + .size_bits = 521, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "00C328FAFCBD79DD77850370C46325D987CB525569FB63C5D3BC53950E6D4C5F174E25A1EE9017B5D450606ADD152B534931D7D4E8455CC91F9B15BF05EC36E377FA", + .s = "00617CCE7CF5064806C467F678D3B4080D6F1CC50AF26CA209417308281B68AF282623EAA63E5B5C0723D8B8C37FF0777B1A20F8CCB1DCCC43997F1EE0E44DA4A67A", + .expected = 0, + }, + { + .test_name = "secp521r1 sha512 error", + .curve_name = "secp521r1", + .x = "01894550D0785932E00EAA23B694F213F8C3121F86DC97A04E5A7167DB4E5BCD371123D46E45DB6B5D5370A7F20FB633155D38FFA16D2BD761DCAC474B9A2F5023A4", + .y = "00493101C962CD4D2FDDF782285E64584139C2F91B47F87FF82354D6630F746A28A0DB25741B5B34A828008B22ACC23F924FAAFBD4D33F81EA66956DFEAA2BFDFCF5", + .size_bits = 521, + .hash_type = "sha-512", + .hash_message = "sample", + .r = "00C328FAFCBD79DD77850370C46325D987CB525569FB63C5D3BC53950E6D4C5F174E25A1EE9017B5D450606ADD152B534931D7D4E8455CC91F9B15BF05EC36E377FA", + .s = "00017CCE7CF5064806C467F678D3B4080D6F1CC50AF26CA209417308281B68AF282623EAA63E5B5C0723D8B8C37FF0777B1A20F8CCB1DCCC43997F1EE0E44DA4A67A", + .expected = -EINVAL, + }, +}; + +static int ecdsa_test(struct unit_test_state *uts, + const struct ecdsa_test_vector_s *tv) +{ + struct ecdsa_public_key pubkey; + unsigned char x[ECDSA_POINT_SIZE]; + unsigned char y[ECDSA_POINT_SIZE]; + unsigned char hash[512 / 8]; + size_t hash_len; + unsigned char signature[ECDSA_SIGNATURE_SIZE]; + size_t sig_len; + int ret; + + sig_len = DIV_ROUND_UP(tv->size_bits, 8); + + pubkey.curve_name = tv->curve_name; + ret = hex2bin(x, tv->x, strlen(tv->x) / 2); + ut_asserteq(0, ret); + pubkey.x = x; + ret = hex2bin(y, tv->y, strlen(tv->y) / 2); + ut_asserteq(0, ret); + pubkey.y = y; + pubkey.size_bits = tv->size_bits; + + if (!strcmp(tv->hash_type, "sha-1")) { +#if CONFIG_IS_ENABLED(SHA1) + hash_len = SHA1_SUM_LEN; + sha1_csum_wd(tv->hash_message, strlen(tv->hash_message), + hash, SHA1_DEF_CHUNK_SZ); +#else + /* sha1 is not supported so we skip this test */ + ut_reportf("Test %s skipped (sha1 not supported)", + tv->test_name); + goto out; +#endif + } else if (!strcmp(tv->hash_type, "sha-256")) { +#if CONFIG_IS_ENABLED(SHA256) + hash_len = SHA256_SUM_LEN; + sha256_csum_wd(tv->hash_message, strlen(tv->hash_message), + hash, CHUNKSZ_SHA256); +#else + /* sha256 is not supported so we skip this test */ + ut_reportf("Test %s skipped (sha256 not supported)", + tv->test_name); + goto out; +#endif + } else if (!strcmp(tv->hash_type, "sha-384")) { +#if CONFIG_IS_ENABLED(SHA384) + hash_len = SHA384_SUM_LEN; + sha384_csum_wd(tv->hash_message, strlen(tv->hash_message), + hash, CHUNKSZ_SHA384); +#else + /* sha384 is not supported so we skip this test */ + ut_reportf("Test %s skipped (sha384 not supported)", + tv->test_name); + goto out; +#endif + } else if (!strcmp(tv->hash_type, "sha-512")) { +#if CONFIG_IS_ENABLED(SHA512) + hash_len = SHA512_SUM_LEN; + sha512_csum_wd(tv->hash_message, strlen(tv->hash_message), + hash, CHUNKSZ_SHA512); +#else + /* sha512 is not supported so we skip this test */ + ut_reportf("Test %s skipped (sha512 not supported)", + tv->test_name); + goto out; +#endif + } else { + ut_reportf("Unknown hash type (%s)", tv->hash_type); + return -EINVAL; + } + + ret = hex2bin(signature, tv->r, sig_len); + ut_asserteq(0, ret); + ret = hex2bin(signature + sig_len, tv->s, sig_len); + ut_asserteq(0, ret); + sig_len = sig_len * 2; + + ret = ecdsa_hash_verify(&pubkey, + hash, hash_len, + signature, sig_len); + ut_asserteq(tv->expected, ret); + +#if !CONFIG_IS_ENABLED(SHA1) || !CONFIG_IS_ENABLED(SHA256) || !CONFIG_IS_ENABLED(SHA384) || !CONFIG_IS_ENABLED(SHA512) + out: +#endif + + return 0; +} + +static int lib_ecdsa(struct unit_test_state *uts) +{ + int i, ret; + size_t num_test = ARRAY_SIZE(ecdsa_test_vector); + + for (i = 0; i < num_test; i++) { + ret = ecdsa_test(uts, &ecdsa_test_vector[i]); + if (ret) + return ret; + } + + return 0; +} + +LIB_TEST(lib_ecdsa, 0); From patchwork Tue Sep 1 15:48:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296097 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=y9XF4tL4; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=JdE12KGz; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9Kt0pGQz1xwZ for ; Wed, 02 Sep 2026 01:50:10 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 6F4E6607C1; Tue, 1 Sep 2026 15:50:08 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id DyEYTwai3GDS; Tue, 1 Sep 2026 15:50:05 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277797; bh=ptp8jOWbGPxpSVUMeICZ4pwzB7EuM7uXBKeZLyiCzPQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=y9XF4tL4t02mCteLvkNQTtm+p69Wa2Ebv/BwalyplVJv06zcRHt9rcsjhu2GfxQFE B66kE1/Vx8SIPSkbwQqHcxRXQJssFK1AMJwytBR7FzsA7tWgmwEZpalrgcID7bWQdV X3z3P3/Rwg1EUy/MV9x/Mn6YOhqV85QXCOW/CFvcfx450axPcm1avt5BDBzlvuz4la //9l9wwV3YEyEEO22Bvt4atTZVrq3EzFsm5qiGbRzvhXm5SPMepduqAiHlW+xvjZ97 xzOIzl08k+OzxPed/X1nWBEwfGURX1sHHSAJcxpSkgVpbuSSq+DZxLPz8ViYeBuZqo TrtBAFzIGrGfw== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id CFA4960794; Tue, 1 Sep 2026 15:49:56 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists1.osuosl.org (Postfix) with ESMTP id 12B9F422 for ; Tue, 1 Sep 2026 15:49:35 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 0317C401ED for ; Tue, 1 Sep 2026 15:49:35 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id zOEGN7_WtLJj for ; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=JdE12KGz Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp2.osuosl.org (Postfix) with ESMTPS id E6EE7400C1 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 858CB83EEF; Tue, 1 Sep 2026 17:49:30 +0200 (CEST) Received: from MRZP264CU002.outbound.protection.outlook.com (mail-francesouthazlp170100001.outbound.protection.outlook.com [IPv6:2a01:111:f403:c207::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E5BFC842FC for ; Tue, 1 Sep 2026 17:48:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="JdE12KGz"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=f2pm5qhW/5oedvBiOLeaVfGF/P1hcR2hqRdnr8m5PWVQf+HRZITmuvQM/UjYCo8NknrleRMKvLb9OA70A0jEOvr3W6wJXhr+Ld54sOE6kJzYZvnFMTnB0JFziUSoqPKowMEhbWeuW78guAtHaKLDgoWwhEVSTTMCZ8NwIsSco7rvn4vvX51zrpvcdnflrmcjx2CHl4zqC/XXH47pQ9XH2mupXFwDG/I+Cx9m+n13GCkDlOQ0Fp08Rj8a9+it9HioFeCsfqfOOLaB+q/hA/9SBOSnWbrLO97v9r9bE4xC+pYmCmSA4ngPKOmea86eCS3IDMl29DxuMUsbPAY4Fmk2jA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ptp8jOWbGPxpSVUMeICZ4pwzB7EuM7uXBKeZLyiCzPQ=; b=sFIzRYsAQKxlufpoz1tdafV8E1Hu9AN4AX+GPIZUEh5fac7I0Tqfk3SzQYzNx5G1CIvzzpeE5HD9MZk47zeFIQkixEwW6K6w2NFsFzaUJB/lHBdbRXvi/EMyvZ+LzIJmJvlqMzwh28pu2P1LlaGxlUfa14/6NrVfh9djqhQwS+OvRHE7SrSanNQkUMAnYpqsEP609C2EoX92Om7EDBvAo3YfY4WUL/cRk4i+jH7uITUIbSQmARTQqbS1kcXMUH3nULRy/2VKZ47fm3EqlgJEIsCoGyEFyBQs6LYrDBLvjg+C/o79LvsREkwZIPkwcSGXoWsKGh3mad3nZwX7ENQFPg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ptp8jOWbGPxpSVUMeICZ4pwzB7EuM7uXBKeZLyiCzPQ=; b=JdE12KGz+/3FTeyMiL5athNl/AGxbHgJXrotE/IBItnDPFWTCFW8C+IFVat6LkapmJ0exa7BytDh3/NRp9SieQimcnYtRJDXUKFMO3zxaaOTNYFjVEz0WWpjNPnObRJWADpQu2tDu87sylsJteCWmRxiL0/6i3bnUuf99Usck3qvnuouvk+nyiAp2jwj6EIabmPi0KxOdoGKzuftRrEqYg8NU2sRKJBtjuvpNULJlvwzF0oyWpaYgQQPeTTwGcyaJ90BC7r00zovkOToyuKw2VQIZH2R2ShuGKG94UoQ+uVwjuRU7KFYglcPy+T26+usH6BLiIeai0HOP2RJsLcJ3w== Received: from MR1P264CA0021.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:2f::8) by MRZP264MB2682.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:1f::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from MR1PEPF00000D57.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:2f:cafe::36) by MR1P264CA0021.outlook.office365.com (2603:10a6:501:2f::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by MR1PEPF00000D57.mail.protection.outlook.com (10.167.241.4) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 85F12202C3; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 05/15] drivers: crypto: add software ecdsa support Date: Tue, 1 Sep 2026 17:48:34 +0200 Message-ID: <20260901154845.102123-6-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MR1PEPF00000D57:EE_|MRZP264MB2682:EE_ X-MS-Office365-Filtering-Correlation-Id: 0d6b3d25-4709-4b80-e0b8-08df08408614 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|82310400026|1800799024|376014|23010399003|36860700016|30052699003|13003099007|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: caGYiZDc4QmK+Z1LqV3SLYvWpZrnhLz5Iqtm67Ieg0CTlJ112YjVHVkjKouDijuScG8ke1ZX1B+FN/8gX8m0JLb06gwdMG1f//QDOVhFlVLQocTkLiBmlicYK1owNE5IUG2vB4PTRTlEhj9qpFNzf7URgFE/e5qfTPOFNptxt2arjV7fph+7PlbaBPdZj8A3E4kh2BOwb/1E98Hlp2KlNLMhPX+qJlYRefQqsDAgsgIQAOWAcwCoA1MAXunCm8PRuaYHgHpUIKufT7gIOScKnbE45SeUBUeOW1i4EyfdoTOmK9Xe+iKs3/RWNqQ1mJwCH50Ywxo+4CHxuiQjjWtMlPs5Di7dWJYbGU9E2pnOHGNJHIwN5PsdW4UYHbmMw7Z0UM+6sXnZ/ClF83jOoa2f7hGzC4Us23AWsFnJKzydXty+IIM67ZrbQLV5I9tFiP42NdNrDRMoBuYDuE69IZVbijqe/2Rk5CJcW8tOVnQWWQXjwISKm48fUwRdYUUytuvP67sv4U17kcxVKqb1G5JPLK1N36afuF2gGjc3yMe3b2fI6hjA28dN7WBWv80saNSmwwvOIuNIZpfHjCW/5gXkICEhquLTIoVJsLis9uzumTGXdu/obMLZcqgTMyRqyiQKH44JLj9PfuLVk2HCOJEUUg== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(82310400026)(1800799024)(376014)(23010399003)(36860700016)(30052699003)(13003099007)(10067099003)(56012099006)(22082099003)(18002099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: aDZ6mpvjRtRBOqruKBEeVpKR31ohiZxCl9RzmF6MV5HVfuysvNGl3hr958S0we2ETn0x/vX7IlPuRvcHN5ihMKxAQGCCW3FgCpdGx9sZ85PyFPGQ317sLFKj8z2Cp1IC5/AhlB6Y1zOWhF8qSGYMj6ElGeJAAYOncq+eCGoQNM3HDu1vLNaZGrTQi7Ut/o9ACFH0ygR9lFkQSu9a/7VW6E0kiGFhL5BPU/mHZszLi2xcciRhNvTIQ7/OjATcvvQZfdqYoExa4hjKMmggLPsCsa8L+7d0fXFqafICrZCIjLb3yYv8as5PY//i+LCz6frsWvvvaaCKRiMdWI9qiQhmOUkSV5BIwUEAEpicu3fc5d5186DAAnw38ecRbB8OVF6Y2RhfIIBOXy0LPUKDDpiyg+xrbHPADrLAMy+t+kAEI2QgqfDbapqQyS0w5sgsCTC8 X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.9684 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0d6b3d25-4709-4b80-e0b8-08df08408614 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: MR1PEPF00000D57.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MRZP264MB2682 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Add a software ecdsa driver so it is now possible to use ecdsa signature on board without ecdsa hardware support. Reviewed-by: Raymond Mao Reviewed-by: Simon Glass Signed-off-by: Philippe Reynes --- v2: - no change v3: - add depends on ECDSA_VERIFY to ECDSA_SW - change sw_ecdsa_verify to ecdsa_hash_verify - v4 - use ECDSA_MBEDTLS to build the driver - clean include (change order) v5: - use $(PHASE_) in the Makefile for the driver v6: - remove include u-boot/ecdsa.h from ecdsa-sw.c v7: - no change v8: - no change v9: - no change drivers/crypto/Makefile | 1 + drivers/crypto/ecdsa/Makefile | 6 ++++++ drivers/crypto/ecdsa/ecdsa-sw.c | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 39 insertions(+) create mode 100644 drivers/crypto/ecdsa/Makefile create mode 100644 drivers/crypto/ecdsa/ecdsa-sw.c diff --git a/drivers/crypto/Makefile b/drivers/crypto/Makefile index e4a4482b7f3..8170e4cae9c 100644 --- a/drivers/crypto/Makefile +++ b/drivers/crypto/Makefile @@ -4,6 +4,7 @@ # http://www.samsung.com obj-$(CONFIG_EXYNOS_ACE_SHA) += ace_sha.o +obj-$(CONFIG_ECDSA) += ecdsa/ obj-y += aes/ obj-y += rsa_mod_exp/ obj-y += fsl/ diff --git a/drivers/crypto/ecdsa/Makefile b/drivers/crypto/ecdsa/Makefile new file mode 100644 index 00000000000..89be50824cb --- /dev/null +++ b/drivers/crypto/ecdsa/Makefile @@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0+ +# +# Copyright (C) 2026 Philippe Reynes +# + +obj-$(CONFIG_$(PHASE_)ECDSA_VERIFY_MBEDTLS) += ecdsa-sw.o diff --git a/drivers/crypto/ecdsa/ecdsa-sw.c b/drivers/crypto/ecdsa/ecdsa-sw.c new file mode 100644 index 00000000000..2af1405f73b --- /dev/null +++ b/drivers/crypto/ecdsa/ecdsa-sw.c @@ -0,0 +1,32 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright (C) 2026 Philippe Reynes + */ +#include +#include +#include +#include + +static int ops_sw_ecdsa_verify(__always_unused struct udevice *dev, + const struct ecdsa_public_key *pubkey, + const void *hash, size_t hash_len, + const void *signature, size_t sig_len) +{ + return ecdsa_hash_verify(pubkey, hash, hash_len, signature, sig_len); +} + +static const struct ecdsa_ops sw_ecdsa_ops = { + .verify = ops_sw_ecdsa_verify, +}; + +U_BOOT_DRIVER(sw_ecdsa) = { + .name = "sw_ecdsa", + .id = UCLASS_ECDSA, + .ops = &sw_ecdsa_ops, + .flags = DM_FLAG_PRE_RELOC, +}; + +U_BOOT_DRVINFO(sw_ecdsa) = { + .name = "sw_ecdsa", +}; + From patchwork Tue Sep 1 15:48:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296086 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=AcGsWCtY; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=losJKPzT; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KM11Hbz1xwZ for ; Wed, 02 Sep 2026 01:49:43 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id A8A3480DF7; Tue, 1 Sep 2026 15:49:41 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 1pCx3D-MkseQ; Tue, 1 Sep 2026 15:49:40 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277780; bh=98SRe5EqxymaPmN8RcW4WzdFX2SG7NpjNwnIWVLcHYE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=AcGsWCtYYnCwpJdOWgmNBKuJhKQBXcKt1lO8t6iQMuLxP42A41c3ccE0g1xYX8vdq ounp97bYnBLRjPBrRN6G2u5WmlVdrojD8kE4HpQhbclDg3w9Y6RatWS2VmYHq3KIUl FqGUskngW91YGzI1HTMPEK+2TSlcmyrWpnjrLOBSqCnw0whBIwkjLomRk18HwHEgHQ qTt7Bx2O6USfFdu78TI2A8kwmvaNkXX2p/iA5BQDU96EYHL8VAHBI59BYcBsfDXnDk SeRRZsWCN4j+dSiR9ObC93m1+XnRldNpyqBXWV8hSKv/088PmJM8Vje2GYwwfzjMeP SswY5GznIggMA== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id AAC2A80DF0; Tue, 1 Sep 2026 15:49:40 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists1.osuosl.org (Postfix) with ESMTP id B8143422 for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 9E7264021D for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 0YaEPFNF_Fu0 for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=losJKPzT Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) by smtp2.osuosl.org (Postfix) with ESMTPS id 64A61401FE for ; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 874A884867; Tue, 1 Sep 2026 17:49:25 +0200 (CEST) Received: from PR0P264CU014.outbound.protection.outlook.com (mail-francecentralazlp170120004.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id D53AF8404D for ; Tue, 1 Sep 2026 17:49:03 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="losJKPzT"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=p6ptDwL4czFdQaQaMedx9UvtqmiuPJuVSDIhAfBcG45xF/oPMs3OEzVnACvj5ZMomdEXNOAiQoMY7jzn7idE+HxbN4AwWtm4gUAou9/l00xz9gPqBbEXGxA8Rg0ZYMHdJuCWQxT4GjTXF1TC1Q0YhEEWqcaLNKsxZsSVHXmrXLMt0dpSdfe6T6XBzTOYkManTSlvGQ/yZNc3RNFVfyx3n4i9DGul8Mr+W1RwfulT+aM8R4C3tm3+Pf49El4winQfCqAl2ibMnerj6PlHh4kOOYbkvtN20SwwzVnsdPNQyXJ1d4RIpHCTqNK1NhXS0CN9AJV4WRuP2jGaUwnDH/VTJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=98SRe5EqxymaPmN8RcW4WzdFX2SG7NpjNwnIWVLcHYE=; b=TNX7W2DjqSa5KMy4+RN067dIrGogmcREXX/VcYSen74SojuY/aCei25sQprhHCrT1bpSyU94S27wMAFTXia3ukA9s1484kf13ME75LJyiKzlZ/Yq4LWf+qot8p4KAn7sUPSJKXXFkp4Qmuyn3e5CZVCA+Hd1JHDYIDyBJAGuY5TuXgKqrsgBBC49WuHLkXIe+0ZF0hfy6lLXp/J0dlzwObWwpfdyQV9xBS+SeIjLXQdjHOvelGftyLdShstR/N1xfAniKN30M+bR0xDHyHeOdmfPmvhna7egD1XKg3kxpPD49BL3e8xWCPwdCk+0qDZ7t+WIs6rjQY9SSyJ7dzfTCA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=98SRe5EqxymaPmN8RcW4WzdFX2SG7NpjNwnIWVLcHYE=; b=losJKPzT6BJW2yfsdBjWA8s8kkretYFfYM/TsW8AQCfRqcQsw+5F6qS7r5llq+KbZbNWROhnEGVVaRPmYnHMQLpejA9Aw8lT3mFxxKLtT4rXDi3FXZgkT+zTpcKhLKQh1Z3fyG+ygeYvswmE4vROsgULP0KEa3hURb2PmVc4Ekq34mzHZJnWG+hcb9ASaFQjFMJfCHEpLTK/G9AhdgmLi29+TYeO/0Jw+5ydSCg2/+e/9pbREfjl/uL8HofrTB3z7qVbEnSuc8EdVUuOXWGz48qkkGGwU0me/yO24y++eVQbd1QGIB8x7lMt0E35J4ltNBc9OflOn7K0ZLYTOP57gg== Received: from DB8PR06CA0045.eurprd06.prod.outlook.com (2603:10a6:10:120::19) by PARP264MB5517.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:3eb::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA1PEPF000CC3FB.FRAP264.PROD.OUTLOOK.COM (2603:10a6:10:120:cafe::55) by DB8PR06CA0045.outlook.office365.com (2603:10a6:10:120::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA1PEPF000CC3FB.mail.protection.outlook.com (10.167.242.6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 9D0D1202FE; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes Subject: [PATCH v9 06/15] test: dm: ecdsa.c: clean this test as software ecdsa is now implemented Date: Tue, 1 Sep 2026 17:48:35 +0200 Message-ID: <20260901154845.102123-7-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA1PEPF000CC3FB:EE_|PARP264MB5517:EE_ X-MS-Office365-Filtering-Correlation-Id: b7487b7a-33c8-469d-a149-08df08408604 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|82310400026|23010399003|36860700016|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: qOlNa56wVi48KGVYHOXt9Fqo1buhtZNXq0LBG/vGxDgkcHGhUjvAc56oaich4l8PCrIY1Jn3GBHdxwOJyBM+14E6vDzVsPj+yzBTXGjgOWWhTM/6I/zRoJsgAV+s7jxJqZ534cDsgFXObvmQ5LSLzuhJR+kK77hwQPUJHgRB020OWu+Bdd/L3vB/Fn5BC7FdWfVwnc60MhOOiEGeNbijpFCxOBhrl71nlArPSYh44mSg6JNGsktTfsbh03f6te8LTMUb0zwofycS2gBGKMSKcCE6+i4JPePSfEXtlfKIwTg3qbY/JiaNciIXxEwotb1DqxbSH6BbJnh3qyKnG+w892UmXJRanhd6oSXXtRPvo7sbKvyNx++6eF10PcMTz6YPtOq6xhiizdBdDitDLLpGlau9SkGGBBgfvQTaR26sG8rQ1jrSLKFpF/1G8DOCQq/VRhGLHo8B5Xh+Qh+hY2VYWvYssoVZ+hjge05P/QIvNFvhYn2q/F0dTZ3oGi3awKGdeeVnzP6YhDlN3HzQCii5qgYEqF5E3rXm3S1U6jl0TS4G2J1a75GaeUiMixTRZj5IYXrr29YroSL3y6QclDAwZ8BQw4waStXFw5FSV0U08sJdFMo9exZtE9MmZLqAAngbhTypMgMWkvuTeZlaqsRYSh73EAwDfblMiOL8zE5woM06Fc19gvmh+TYW7pCqi99RpHQ9ccuoOHlRNEThiYMiQg== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(82310400026)(23010399003)(36860700016)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: eSNt41j8/x+5XNypQDMEV2GvqhNrwGhZ/7EWmRj3U9hSoBIETXWQ88SuVdes/RXGySu7KPj4kidfFhz829o7dsV3rOB9FoduGxQ7m6gF9R3/nYzFjJ0BT+m//v5Ky8RSOp9kgZ6ngIZGXPZCdcm7geGNmk6AOaKWsBJUs12i5akLPJdTGTvOsx4c5bzZfmXFJzzujFFR+J043o3bGPCkMh4e0geo0y9LNfjMDCUoEh/kmSd9AwjX7zW89j1ksCX4zAaMUpjWePwHt54D4J7rJXnKv041vv7ZFx1cIvGi/ktfsJJQ0N6VgXN3Gx/cO9mMOyUH6axRvvbQSn6pKA3DsFy6XJcgAwoB5ibh7jNkp0zoSMNBcV9BbfbTFrmbGyqTBun8MjmSY1FmjbND80P9Tzy99xiLuv7Fez5uXqrEu3NpBuHm7Tjt6OSFzheLfySy X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.8807 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b7487b7a-33c8-469d-a149-08df08408604 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA1PEPF000CC3FB.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PARP264MB5517 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org The test ecdsa was done when ecdsa was only supported by hardware. So it wasn't possible to test ecdsa on sandbox, and there is a test to check that ecdsa is not supported on sandbox. Now, there is a software implementation of ecdsa. So we add a test to verify that ecdsa_verify may be used on sandbox. Signed-off-by: Philippe Reynes --- v2: - initial version v3: - no change v4: - add a test that use ecdsa_verify v5: - change secp256r1 to ecdsa256 - check that checksum and crypto are not null v6: - update commit message - remove fdt_strerror in macro CHECK - return ENOMEM when malloc fails - add a define FDT_MAX_SIZE to avoid hardcoded value v7: - change uint8_t to u8 - set required_keynode to -1 v8: - remove macro CHECK with a goto inside - use lowercase for hex data - code cleanup v9: - no change test/dm/ecdsa.c | 107 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 97 insertions(+), 10 deletions(-) diff --git a/test/dm/ecdsa.c b/test/dm/ecdsa.c index d7eac7115f7..261ca3f9f73 100644 --- a/test/dm/ecdsa.c +++ b/test/dm/ecdsa.c @@ -3,36 +3,123 @@ #include #include #include +#include #include #include +#define FDT_MAX_SIZE 512 + +static int set_fdt_ecdsa_point(char *fdt, const char *name, const char *data) +{ + char *value = NULL; + size_t len; + int ret = 0; + + if (!fdt || !name || !data) { + ret = -EINVAL; + goto out; + } + + len = strlen(data) / 2; + if (!len) { + ret = -EINVAL; + goto out; + } + + value = malloc(len); + if (!value) { + ret = -ENOMEM; + goto out; + } + + ret = hex2bin(value, data, len); + if (ret) + goto out; + + ret = fdt_property(fdt, name, value, len); + if (ret) + goto out; + +out: + free(value); + return ret; +} + +static int create_fdt_with_ecdsa_key(struct unit_test_state *uts, + char *fdt, size_t size, + const char *name, const char *curve, + const char *x, const char *y) +{ + ut_assertok(fdt_create(fdt, size)); + ut_assertok(fdt_finish_reservemap(fdt)); + ut_assertok(fdt_begin_node(fdt, "")); + ut_assertok(fdt_begin_node(fdt, "signature")); + ut_assertok(fdt_begin_node(fdt, name)); + ut_assertok(fdt_property_string(fdt, "algo", "sha256,ecdsa256")); + ut_assertok(set_fdt_ecdsa_point(fdt, "ecdsa,y-point", y)); + ut_assertok(set_fdt_ecdsa_point(fdt, "ecdsa,x-point", x)); + ut_assertok(fdt_property_string(fdt, "ecdsa,curve", curve)); + ut_assertok(fdt_property_string(fdt, "key-name-hint", name)); + ut_assertok(fdt_end_node(fdt)); /* name */ + ut_assertok(fdt_end_node(fdt)); /* "signature" */ + ut_assertok(fdt_end_node(fdt)); /* "" */ + ut_assertok(fdt_finish(fdt)); + ut_assertok(fdt_pack(fdt)); + + return 0; +} + /* * Basic test of the ECDSA uclass and ecdsa_verify() * - * ECDSA implementations in u-boot are hardware-dependent. Until we have a - * software implementation that can be compiled into the sandbox, all we can - * test is the uclass support. + * ECDSA software implementation is tested in another test, + * so we only check that the UCLASS_ECDSA uclass may be used. * - * The uclass_get() test is redundant since ecdsa_verify() would also fail. We - * run both functions in order to isolate the cause more clearly. i.e. is - * ecdsa_verify() failing because the UCLASS is absent/broken? + * The data used in this test come from RFC6979 and use the + * sample with curve NIST P-256, hash sha256 and text "sample". */ static int dm_test_ecdsa_verify(struct unit_test_state *uts) { struct uclass *ucp; + const char *full_name = "sha256,ecdsa256"; + const char *name = "key-ecdsa-256"; + const char *curve = "prime256v1"; + const char *x = "60fed4ba255a9d31c961eb74c6356d68c049b8923b61fa6ce669622e60f29fb6"; + const char *y = "7903fe1008b8bc99a41ae9e95628bc64f2f1b20c2d7e9f5177a3c294d4462299"; + const char *r = "efd48b2aacb6a8fd1140dd9cd45e81d69d2c877b56aaf991c34d0ea84eaf3716"; + const char *s = "f7cb1c942d657c41d436c7a1b6e29f65f3e900dbb9aff4064dc4ab2f843acda8"; + u8 sig[64]; + char fdt[FDT_MAX_SIZE]; - struct checksum_algo algo = { - .checksum_len = 256, + struct image_region region[] = { + { + .data = "sample", + .size = strlen("sample"), + }, }; struct image_sign_info info = { - .checksum = &algo, + .checksum = image_get_checksum_algo(full_name), + .crypto = image_get_crypto_algo(full_name), + .required_keynode = -1, + .fdt_blob = fdt, }; + ut_assertnonnull(info.checksum); + ut_assertnonnull(info.crypto); + + /* create a fdt with the public key */ + ut_assertok(create_fdt_with_ecdsa_key(uts, fdt, sizeof(fdt), name, curve, x, y)); + + /* prepare the signature */ + ut_assertok(hex2bin(sig + 0, r, strlen(r) / 2)); + ut_assertok(hex2bin(sig + 32, s, strlen(s) / 2)); + ut_assertok(uclass_get(UCLASS_ECDSA, &ucp)); ut_assertnonnull(ucp); - ut_asserteq(-ENODEV, ecdsa_verify(&info, NULL, 0, NULL, 0)); + ut_assertok(ecdsa_verify(&info, region, 1, sig, sizeof(sig))); return 0; } + DM_TEST(dm_test_ecdsa_verify, UTF_SCAN_PDATA | UTF_SCAN_FDT); From patchwork Tue Sep 1 15:48:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296091 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=Lbw1UBaL; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=fJJnYh8q; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KX0lCYz1xwg for ; Wed, 02 Sep 2026 01:49:52 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id BCB9180DFE; Tue, 1 Sep 2026 15:49:50 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id bUiChIeQ5T-B; Tue, 1 Sep 2026 15:49:49 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277789; bh=UiCZ75Pm6RupzSI3YQI/+Pai2kuEApVy/R4vIcVlyP8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=Lbw1UBaL54DA6YNMhkBApSbq+FX2Vq+7E4cTawiNNfeQWGIxrFnhbxCC25oDGRUMO djXS/XqBdgxWoC8DCnBUxkc7aveNJGr7xobz9kVGDS1u5r6KDBV31LHk4H1TkkeZ3d 2qlB/n9rnFum43gKACpd5gaKZBn+J7Geh01647RO1jyMeGW5+OXCgi66eT9kmmwPaS o95YFTCRZX3axdmWoZPlQllWMpIup0UcuP4ql87huqgNZ6Skn5+z1bXpnlTYdSb1qt pSwpa6oow+ewe23tbION96yxE9aZyX0fzWm2+szsBN0rf6yDGgjGbcLBiExsn1YpCB jvg2TeQJBcsfA== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id 3C48780E04; Tue, 1 Sep 2026 15:49:49 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) by lists1.osuosl.org (Postfix) with ESMTP id EC833279 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id DBC1F60787 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id ejILk6_5xpTG for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp3.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=fJJnYh8q Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) by smtp3.osuosl.org (Postfix) with ESMTPS id 3CAFD6078B for ; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 6D96784671; Tue, 1 Sep 2026 17:49:23 +0200 (CEST) Received: from MRZP264CU002.outbound.protection.outlook.com (mail-francesouthazlp170100001.outbound.protection.outlook.com [IPv6:2a01:111:f403:c207::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E156E84867 for ; Tue, 1 Sep 2026 17:49:00 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="fJJnYh8q"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MTjpERxqKf6kb72JD5cPHqkAGXe+e8o2sisVpIUWq45RGiQUGTdGUGFTkoWdA9avGcILbw8QEpy8jQ/8KA5BeFHjo4zZ0tZc6wQMGikv9dLGIZ4xboGmD6R1XUbmUY+dS32U+wJSkPZB7+xv8Y4ep/cG8JkGBKMHATofvmgyqS/VRoEZ5xeyRWMpQbuPJDpoqbtrEYNZnIwSE8CydGsFN80MFhib/HgCCvOPdXl7DHJocVBLrG0MoWOInDBl2hsspaGGI5uzMAHAY+5Im5v0RgEM2JE0VN+G231DcysGFChXm1PmrFxaeOl8vfhkNxjo6jezYajmvrvpE4AVFf3Odg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UiCZ75Pm6RupzSI3YQI/+Pai2kuEApVy/R4vIcVlyP8=; b=eYr1OtOgfu31bWvdshd+HJK25QJrZUD1DSkP5AJGOiZF6eKZ9Q9aHQgB+PIJZNnkYI55zEgByPD2Iw4Kn+0Odw3LEscyHSauQ9dNXV8AbZXUU9H92jHmpDdopCwnMfiBCHZNA46zEAErDu8g88YzszcWSz0yHKDiqUbxD8iziSnjNdCQGUF9Wegz0ctPonsBJk9NeEPlcfoxWa89P1Va5ZLVZI+jZbcl2yGswis3w1/jsadtDfaRnAyQeIhyQ5HhQSinihbMwnuxhs9RcNQg9xOgEM7Oxs5P75s2k0GYmm3NDIJpRtcbsG5JMeUV5rukjSVx3Y7n0+iKtAv4WNDK+A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UiCZ75Pm6RupzSI3YQI/+Pai2kuEApVy/R4vIcVlyP8=; b=fJJnYh8q3JRPJLZamLWpd2sAtSdIkLpAM0/IIqe3uLkKavIhoFtzCH6T6KuOXrt5ZDuPP2BmoUUUxOymIaaF3V61vvhg1m+ydFa/XFjYx0jyUYykwI42iAzDJQAEJBJiN6ziwb1mmSvBzxgvaDNTNeq3kwvp4ywep3/H4lAmjlLvJMgJYdpgy5Fmp4XcCVmm8spb6VWIaZM9NHL+QXhwgfCf5GEG3NwK/lv3Fi9gNd2B9LWY0vGLPCexP3eVBt8r8qFpGEaeAEGMQlz8kUiDUtP/jZj0qXT4QwFUdJXEpvdNEuyFibKfxlk53+wrmy3J7cDzouKUbRk0QhIaLtN86Q== Received: from PR3P193CA0053.EURP193.PROD.OUTLOOK.COM (2603:10a6:102:51::28) by PR0P264MB1676.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:168::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA3PEPF000089BA.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:51:cafe::67) by PR3P193CA0053.outlook.office365.com (2603:10a6:102:51::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA3PEPF000089BA.mail.protection.outlook.com (10.167.242.22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id B3148203AA; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 07/15] test: py: vboot: prepare integration test for ecdsa Date: Tue, 1 Sep 2026 17:48:36 +0200 Message-ID: <20260901154845.102123-8-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA3PEPF000089BA:EE_|PR0P264MB1676:EE_ X-MS-Office365-Filtering-Correlation-Id: 46fef6f2-1b6c-48ec-e809-08df08408606 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|82310400026|23010399003|36860700016|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: GNppC0F1lKPR/+Ql8O2PwNXKggFofQmCtdu/6o+X0tCtQgUpRp/q/hY7i9hpOCTQTjabK120JS7wclmxnJktGmIxO1goPqzecktObs0GNE23e8yEGJck4w+dhYdGmKJrVAOc3DL20+IH68StAnnQo9t5lAY3cNCNKLU17WI5Titp6bgoEV0PKFkF9giR21QSvlGrV5dKqOTfNZ1kol2TYe/sdA3D7yZju7IZ9xQPPiQ5eCkcshVrv9qmbtOvByPapFgIUD0N9g9RRsB090EDmFMeyz6n5JJJpKX1gSjuXjsy2oQvL8A4vqr5jOxuMmDsj8kiyPCbZ0ECqyBc1mxoTiaBWWzEi4RIcCk85H2GuWPiukPq4Y2ZgXx9bTGaef+vefDMHo0TIVfnQeUlTJJ+uCIBHl7kReP5rjGwromtYP+4emJC/a6rjWgxYV5pB52DR1n6eaMPsuV7d8Mwy3SfRzqGPZ5HXnVgn+BmycfiDOdb71Zh5DtvA+26QUrtWs0gtev/2WtM39gPTq6JFpa8iwKrfbfU1HTxv97hrV4UCyPOVBFKxxd7knjL7WJmpg2IkA0r9sywXj9JqlNNCh/DOF2h8/ccN29zN+KerSDoQbXdgbk8Qz6g7DTXFxoW11iOf1XkETCj1LhDyssml/liiDsAxvpRvjUS87WJyAEVVawVpgZefF2HjlEX4L8nkDAGKha+/FBRm2Wa80qkbMQguA== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(82310400026)(23010399003)(36860700016)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: kyCISL9B3RyfmWHm+HRsFqJUDeyb1PXFU1SPoVM9pYHhjQFgvKDzlX3gq8JJsImkeLlZaF6PTXPj/RXx39Takp60kO9HxsBbfM66nEw8q5Wot+LUYCceTtPRgWjLha1NheULLHepxT8sRF+NL8TDrhilo2G8LyceaA0Vl/RKwmr04lAf5SDUYJNIuNLblPYaOA8aQrS9dwHVWVzmy14yRo82H7ICHE7CCKn7SRmP2n2ir6s38EcRNdB0Hoep6yHC9asdgsZCQGwNfWdjny5YghS4cJjSd/tJwkEv5cgyARd7Fchu3T7m7J5A71FQea50Y7Cm3JggHE3W0jul2hGzm6Jayllej3X7fxkQ/OJ3Gmv79Jd38Xm9L2HBz8h+G0rdcBXQu4Vi06xP1tAtnIk5vj5uhVhWvfvjWRsxNFFsbQrKPeluKbOU4DxsL78jDfRN X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.8977 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 46fef6f2-1b6c-48ec-e809-08df08408606 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA3PEPF000089BA.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR0P264MB1676 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org The vboot tests only consider rsa algo for signature. To prepare the integration of ecdsa test, the signature algo is now explicit. Reviewed-by: Simon Glass Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v2: - initial version v3: - no change v4: - no change v5: - no change v6: - no change v7: - no change v8: - no change v9: - some minor update to fix rebase on next test/py/tests/test_fit_ecdsa.py | 2 +- test/py/tests/test_vboot.py | 104 +++++++++--------- ....its => sign-configs-sha1-rsa2048-pss.its} | 0 ...sha1.its => sign-configs-sha1-rsa2048.its} | 0 ... sign-configs-sha256-rsa2048-pss-prod.its} | 0 ...ts => sign-configs-sha256-rsa2048-pss.its} | 0 ...56.its => sign-configs-sha256-rsa2048.its} | 0 ...84.its => sign-configs-sha384-rsa3072.its} | 0 ...s.its => sign-images-sha1-rsa2048-pss.its} | 0 ...-sha1.its => sign-images-sha1-rsa2048.its} | 0 ...its => sign-images-sha256-rsa2048-pss.its} | 0 ...256.its => sign-images-sha256-rsa2048.its} | 0 ...384.its => sign-images-sha384-rsa3072.its} | 0 13 files changed, 54 insertions(+), 52 deletions(-) rename test/py/tests/vboot/{sign-configs-sha1-pss.its => sign-configs-sha1-rsa2048-pss.its} (100%) rename test/py/tests/vboot/{sign-configs-sha1.its => sign-configs-sha1-rsa2048.its} (100%) rename test/py/tests/vboot/{sign-configs-sha256-pss-prod.its => sign-configs-sha256-rsa2048-pss-prod.its} (100%) rename test/py/tests/vboot/{sign-configs-sha256-pss.its => sign-configs-sha256-rsa2048-pss.its} (100%) rename test/py/tests/vboot/{sign-configs-sha256.its => sign-configs-sha256-rsa2048.its} (100%) rename test/py/tests/vboot/{sign-configs-sha384.its => sign-configs-sha384-rsa3072.its} (100%) rename test/py/tests/vboot/{sign-images-sha1-pss.its => sign-images-sha1-rsa2048-pss.its} (100%) rename test/py/tests/vboot/{sign-images-sha1.its => sign-images-sha1-rsa2048.its} (100%) rename test/py/tests/vboot/{sign-images-sha256-pss.its => sign-images-sha256-rsa2048-pss.its} (100%) rename test/py/tests/vboot/{sign-images-sha256.its => sign-images-sha256-rsa2048.its} (100%) rename test/py/tests/vboot/{sign-images-sha384.its => sign-images-sha384-rsa3072.its} (100%) diff --git a/test/py/tests/test_fit_ecdsa.py b/test/py/tests/test_fit_ecdsa.py index 3e816d68eb6..e59390374af 100644 --- a/test/py/tests/test_fit_ecdsa.py +++ b/test/py/tests/test_fit_ecdsa.py @@ -102,7 +102,7 @@ def test_fit_ecdsa(ubman): with open(key_file, 'w') as f: f.write(key.export_key(format='PEM')) - assemble_fit_image(fit_file, f'{datadir}/sign-images-sha256.its', tempdir) + assemble_fit_image(fit_file, f'{datadir}/sign-images-sha256-rsa2048.its', tempdir) fit = SignableFitImage(ubman, fit_file) nodes = fit.find_signable_image_nodes() diff --git a/test/py/tests/test_vboot.py b/test/py/tests/test_vboot.py index e9259584e32..33cbcea5c24 100644 --- a/test/py/tests/test_vboot.py +++ b/test/py/tests/test_vboot.py @@ -84,21 +84,21 @@ def make_fit(its, ubman, mkimage, dtc_args, datadir, fit): # Only run the full suite on a few combinations, since it doesn't add any more # test coverage. TESTDATA_IN = [ - ['sha1-basic', 'sha1', '', None, False, True, False, False], - ['sha1-pad', 'sha1', '', '-E -p 0x10000', False, False, False, False], - ['sha1-pss', 'sha1', '-pss', None, False, False, False, False], - ['sha1-pss-pad', 'sha1', '-pss', '-E -p 0x10000', False, False, False, False], - ['sha256-basic', 'sha256', '', None, False, False, False, False], - ['sha256-pad', 'sha256', '', '-E -p 0x10000', False, False, False, False], - ['sha256-pss', 'sha256', '-pss', None, False, False, False, False], - ['sha256-pss-pad', 'sha256', '-pss', '-E -p 0x10000', False, False, False, False], - ['sha256-pss-required', 'sha256', '-pss', None, True, False, False, False], - ['sha256-pss-pad-required', 'sha256', '-pss', '-E -p 0x10000', True, True, False, False], - ['sha384-basic', 'sha384', '', None, False, False, False, False], - ['sha384-pad', 'sha384', '', '-E -p 0x10000', False, False, False, False], - ['algo-arg', 'algo-arg', '', '-o sha256,rsa2048', False, False, True, False], - ['sha256-global-sign', 'sha256', '', '', False, False, False, True], - ['sha256-global-sign-pss', 'sha256', '-pss', '', False, False, False, True], + ['sha1-basic', 'sha1', '-rsa2048', '', None, False, True, False, False], + ['sha1-pad', 'sha1', '-rsa2048', '', '-E -p 0x10000', False, False, False, False], + ['sha1-pss', 'sha1', '-rsa2048', '-pss', None, False, False, False, False], + ['sha1-pss-pad', 'sha1', '-rsa2048', '-pss', '-E -p 0x10000', False, False, False, False], + ['sha256-basic', 'sha256', '-rsa2048', '', None, False, False, False, False], + ['sha256-pad', 'sha256', '-rsa2048', '', '-E -p 0x10000', False, False, False, False], + ['sha256-pss', 'sha256', '-rsa2048', '-pss', None, False, False, False, False], + ['sha256-pss-pad', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', False, False, False, False], + ['sha256-pss-required', 'sha256', '-rsa2048', '-pss', None, True, False, False, False], + ['sha256-pss-pad-required', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', True, True, False, False], + ['sha384-basic', 'sha384', '-rsa3072', '', None, False, False, False, False], + ['sha384-pad', 'sha384', '-rsa3072', '', '-E -p 0x10000', False, False, False, False], + ['algo-arg', 'algo-arg', '', '', '-o sha256,rsa2048', False, False, True, False], + ['sha256-global-sign', 'sha256', '-rsa2048', '', '', False, False, False, True], + ['sha256-global-sign-pss', 'sha256', '-rsa2048', '-pss', '', False, False, False, True], ] # Mark all but the first test as slow, so they are not run with '-k not slow' @@ -111,9 +111,9 @@ TESTDATA += [pytest.param(*v, marks=pytest.mark.slow) for v in TESTDATA_IN[1:]] @pytest.mark.requiredtool('fdtget') @pytest.mark.requiredtool('fdtput') @pytest.mark.requiredtool('openssl') -@pytest.mark.parametrize("name,sha_algo,padding,sign_options,required,full_test,algo_arg,global_sign", +@pytest.mark.parametrize("name,sha_algo,sig_algo,padding,sign_options,required,full_test,algo_arg,global_sign", TESTDATA) -def test_vboot(ubman, name, sha_algo, padding, sign_options, required, +def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required, full_test, algo_arg, global_sign): """Test verified boot signing with mkimage and verification with 'bootm'. @@ -287,7 +287,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, utils.run_and_log(ubman, 'openssl req -batch -new -x509 -key %s%s.key ' '-out %s%s.crt' % (tmpdir, name, tmpdir, name)) - def test_with_algo(sha_algo, padding, sign_options): + def test_with_algo(sha_algo, sig_algo, padding, sign_options): """Test verified boot with the given hash algorithm. This is the main part of the test code. The same procedure is followed @@ -308,7 +308,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, # Build the FIT, but don't sign anything yet ubman.log.action('%s: Test FIT with signed images' % sha_algo) - make_fit('sign-images-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-images-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) run_bootm(sha_algo, 'unsigned images', ' - OK' if algo_arg else 'dev-', True) # Sign images with our dev keys @@ -319,7 +319,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, dtc('sandbox-u-boot.dts', ubman, dtc_args, datadir, tmpdir, dtb) ubman.log.action('%s: Test FIT with signed configuration' % sha_algo) - make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) run_bootm(sha_algo, 'unsigned config', '%s+ OK' % ('sha256' if algo_arg else sha_algo), True) # Sign images with our dev keys @@ -390,7 +390,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, run_bootm(sha_algo, 'evil clone', 'Bad Data Hash', False, efit) # Create a new properly signed fit and replace header bytes - make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) sign_fit(sha_algo, sign_options) bcfg = ubman.config.buildconfig max_size = int(bcfg.get('config_fit_signature_max_size', 0x10000000), 0) @@ -424,7 +424,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, # Create a new properly signed fit and replace hashed-strings # size property - make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) sign_fit(sha_algo, sign_options) utils.run_and_log(ubman, 'fdtput -t x %s %s hashed-strings 0' % (fit, sig_node)) @@ -448,7 +448,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, 'Bad Data Hash', False) ubman.log.action('%s: Check in-bounds hashed-strings size' % sha_algo) - def test_required_key(sha_algo, padding, sign_options): + def test_required_key(sha_algo, sig_algo, padding, sign_options): """Test verified boot with the given hash algorithm. This function tests if U-Boot rejects an image when a required key isn't @@ -470,12 +470,12 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, # Build the FIT with prod key (keys required) and sign it. This puts the # signature into sandbox-u-boot.dtb, marked 'required' - make_fit('sign-configs-%s%s-prod.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-configs-%s%s%s-prod.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) sign_fit(sha_algo, sign_options) # Build the FIT with dev key (keys NOT required). This adds the # signature into sandbox-u-boot.dtb, NOT marked 'required'. - make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) sign_fit_norequire(sha_algo, sign_options) # So now sandbox-u-boot.dtb two signatures, for the prod and dev keys. @@ -487,7 +487,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, # Build the FIT with dev key (keys required) and sign it. This puts the # signature into sandbox-u-boot.dtb, marked 'required'. - make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) sign_fit(sha_algo, sign_options) # Set the required-mode policy to "any". @@ -567,8 +567,9 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, dtb = '%ssandbox-u-boot.dtb' % tmpdir sig_node = '/configurations/conf-1/signature' - create_rsa_pair('dev') - create_rsa_pair('prod') + if sig_algo == "-rsa2048" or sig_algo == "-rsa3072" or sig_algo == "": + create_rsa_pair('dev') + create_rsa_pair('prod') # Create a number kernel image with zeroes with open('%stest-kernel.bin' % tmpdir, 'wb') as fd: @@ -587,9 +588,9 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required, if global_sign: test_global_sign(sha_algo, padding, sign_options) elif required: - test_required_key(sha_algo, padding, sign_options) + test_required_key(sha_algo, sig_algo, padding, sign_options) else: - test_with_algo(sha_algo, padding, sign_options) + test_with_algo(sha_algo, sig_algo, padding, sign_options) finally: # Go back to the original U-Boot with the correct dtb. ubman.config.dtb = old_dtb @@ -616,6 +617,7 @@ def test_vboot_ext_data_bounds(ubman): by U-Boot to hold public keys from the signing process. """ sha_algo = 'sha256' + sig_algo = '-rsa2048' def run_bootm(test_type, expect_string): """Run a 'bootm' command in U-Boot and expect it to fail. @@ -684,7 +686,7 @@ def test_vboot_ext_data_bounds(ubman): sign_fit() overwrites the FIT, so a new one is built before each test case mutates its external-data properties. """ - make_fit('sign-configs-%s.its' % sha_algo, ubman, mkimage, dtc_args, + make_fit('sign-configs-%s%s.its' % (sha_algo, sig_algo), ubman, mkimage, dtc_args, datadir, fit) sign_fit('-E') @@ -762,21 +764,21 @@ def test_vboot_ext_data_bounds(ubman): TESTDATA_IN = [ - ['sha1-basic', 'sha1', '', None, False], - ['sha1-pad', 'sha1', '', '-E -p 0x10000', False], - ['sha1-pss', 'sha1', '-pss', None, False], - ['sha1-pss-pad', 'sha1', '-pss', '-E -p 0x10000', False], - ['sha256-basic', 'sha256', '', None, False], - ['sha256-pad', 'sha256', '', '-E -p 0x10000', False], - ['sha256-pss', 'sha256', '-pss', None, False], - ['sha256-pss-pad', 'sha256', '-pss', '-E -p 0x10000', False], - ['sha256-pss-required', 'sha256', '-pss', None, False], - ['sha256-pss-pad-required', 'sha256', '-pss', '-E -p 0x10000', False], - ['sha384-basic', 'sha384', '', None, False], - ['sha384-pad', 'sha384', '', '-E -p 0x10000', False], - ['algo-arg', 'algo-arg', '', '-o sha256,rsa2048', True], - ['sha256-global-sign', 'sha256', '', '', False], - ['sha256-global-sign-pss', 'sha256', '-pss', '', False], + ['sha1-basic', 'sha1', '-rsa2048', '', None, False], + ['sha1-pad', 'sha1', '-rsa2048', '', '-E -p 0x10000', False], + ['sha1-pss', 'sha1', '-rsa2048', '-pss', None, False], + ['sha1-pss-pad', 'sha1', '-rsa2048', '-pss', '-E -p 0x10000', False], + ['sha256-basic', 'sha256', '-rsa2048', '', None, False], + ['sha256-pad', 'sha256', '-rsa2048', '', '-E -p 0x10000', False], + ['sha256-pss', 'sha256', '-rsa2048', '-pss', None, False], + ['sha256-pss-pad', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', False], + ['sha256-pss-required', 'sha256', '-rsa2048', '-pss', None, False], + ['sha256-pss-pad-required', 'sha256', '-rsa2048' , '-pss', '-E -p 0x10000', False], + ['sha384-basic', 'sha384', '-rsa3072', '', None, False], + ['sha384-pad', 'sha384', '-rsa3072', '', '-E -p 0x10000', False], + ['algo-arg', 'algo-arg', '', '', '-o sha256,rsa2048', True], + ['sha256-global-sign', 'sha256', '-rsa2048', '', '', False], + ['sha256-global-sign-pss', 'sha256', '-rsa2048', '-pss', '', False], ] # Mark all but the first test as slow, so they are not run with '-k not slow' @@ -787,8 +789,8 @@ TESTDATA += [pytest.param(*v, marks=pytest.mark.slow) for v in TESTDATA_IN[1:]] @pytest.mark.buildconfigspec('fit_signature') @pytest.mark.requiredtool('dtc') @pytest.mark.requiredtool('openssl') -@pytest.mark.parametrize("name,sha_algo,padding,sign_options,algo_arg", TESTDATA) -def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg): +@pytest.mark.parametrize("name,sha_algo,sig_algo,padding,sign_options,algo_arg", TESTDATA) +def test_fdt_add_pubkey(ubman, name, sha_algo, sig_algo, padding, sign_options, algo_arg): """Test fdt_add_pubkey utility with bunch of different algo options.""" def sign_fit(sha_algo, options): @@ -807,7 +809,7 @@ def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg): ubman.log.action('%s: Sign images' % sha_algo) utils.run_and_log(ubman, args) - def test_add_pubkey(sha_algo, padding, sign_options): + def test_add_pubkey(sha_algo, sig_algo, padding, sign_options): """Test fdt_add_pubkey utility with given hash algorithm and padding. This function tests if fdt_add_pubkey utility may add public keys into dtb. @@ -830,7 +832,7 @@ def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg): 'rsa3072' if sha_algo == 'sha384' else 'rsa2048'), '-k', tmpdir, '-n', 'dev', '-r', 'conf', dtb]) - make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit) + make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit) # Sign images with our dev keys sign_fit(sha_algo, sign_options) @@ -852,4 +854,4 @@ def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg): # keys created in test_vboot test - test_add_pubkey(sha_algo, padding, sign_options) + test_add_pubkey(sha_algo, sig_algo, padding, sign_options) diff --git a/test/py/tests/vboot/sign-configs-sha1-pss.its b/test/py/tests/vboot/sign-configs-sha1-rsa2048-pss.its similarity index 100% rename from test/py/tests/vboot/sign-configs-sha1-pss.its rename to test/py/tests/vboot/sign-configs-sha1-rsa2048-pss.its diff --git a/test/py/tests/vboot/sign-configs-sha1.its b/test/py/tests/vboot/sign-configs-sha1-rsa2048.its similarity index 100% rename from test/py/tests/vboot/sign-configs-sha1.its rename to test/py/tests/vboot/sign-configs-sha1-rsa2048.its diff --git a/test/py/tests/vboot/sign-configs-sha256-pss-prod.its b/test/py/tests/vboot/sign-configs-sha256-rsa2048-pss-prod.its similarity index 100% rename from test/py/tests/vboot/sign-configs-sha256-pss-prod.its rename to test/py/tests/vboot/sign-configs-sha256-rsa2048-pss-prod.its diff --git a/test/py/tests/vboot/sign-configs-sha256-pss.its b/test/py/tests/vboot/sign-configs-sha256-rsa2048-pss.its similarity index 100% rename from test/py/tests/vboot/sign-configs-sha256-pss.its rename to test/py/tests/vboot/sign-configs-sha256-rsa2048-pss.its diff --git a/test/py/tests/vboot/sign-configs-sha256.its b/test/py/tests/vboot/sign-configs-sha256-rsa2048.its similarity index 100% rename from test/py/tests/vboot/sign-configs-sha256.its rename to test/py/tests/vboot/sign-configs-sha256-rsa2048.its diff --git a/test/py/tests/vboot/sign-configs-sha384.its b/test/py/tests/vboot/sign-configs-sha384-rsa3072.its similarity index 100% rename from test/py/tests/vboot/sign-configs-sha384.its rename to test/py/tests/vboot/sign-configs-sha384-rsa3072.its diff --git a/test/py/tests/vboot/sign-images-sha1-pss.its b/test/py/tests/vboot/sign-images-sha1-rsa2048-pss.its similarity index 100% rename from test/py/tests/vboot/sign-images-sha1-pss.its rename to test/py/tests/vboot/sign-images-sha1-rsa2048-pss.its diff --git a/test/py/tests/vboot/sign-images-sha1.its b/test/py/tests/vboot/sign-images-sha1-rsa2048.its similarity index 100% rename from test/py/tests/vboot/sign-images-sha1.its rename to test/py/tests/vboot/sign-images-sha1-rsa2048.its diff --git a/test/py/tests/vboot/sign-images-sha256-pss.its b/test/py/tests/vboot/sign-images-sha256-rsa2048-pss.its similarity index 100% rename from test/py/tests/vboot/sign-images-sha256-pss.its rename to test/py/tests/vboot/sign-images-sha256-rsa2048-pss.its diff --git a/test/py/tests/vboot/sign-images-sha256.its b/test/py/tests/vboot/sign-images-sha256-rsa2048.its similarity index 100% rename from test/py/tests/vboot/sign-images-sha256.its rename to test/py/tests/vboot/sign-images-sha256-rsa2048.its diff --git a/test/py/tests/vboot/sign-images-sha384.its b/test/py/tests/vboot/sign-images-sha384-rsa3072.its similarity index 100% rename from test/py/tests/vboot/sign-images-sha384.its rename to test/py/tests/vboot/sign-images-sha384-rsa3072.its From patchwork Tue Sep 1 15:48:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296085 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=usicCH4j; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=PBD4tzUE; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KJ2mqVz1xwZ for ; Wed, 02 Sep 2026 01:49:40 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 2365960787; Tue, 1 Sep 2026 15:49:37 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id P9EPlCZ5ahNO; Tue, 1 Sep 2026 15:49:36 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277776; bh=K6FPFqFaCxxEnT3g2ero1OSTFNY0NYcEKpvmBbOnKao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=usicCH4jyFqyB7bSb7R4z9hu6NzxmtK+cMnB59KoPbxx1/NOhAlMh+0llQh6L457h 8mIYmcMCWhip50wEr7XWWl/yXznzHEeBYyUHJf6/fQuJu8gZay7iwCk+frTIh4QYS4 ZcXVG1ZYp4MnzK/Qm3LDGJkZcgyL5YbQHwVWVEqtXXvlRqbCtKUFjtRZdSa4CbEdoB VzUXkB4bUy0kP8NVn+sh9QrNYP/6jsUbWgcuMixRqH7K1nGbwzA00GA7oyj03kHWIO Fz12c09CWknvjfiF6aR1m7VZIhOI8L6A6K+KRVP6xwhxzEPl74us+TsRXRlcqGJFq9 ++CmoCyULCrtg== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id E87CD607BA; Tue, 1 Sep 2026 15:49:35 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists1.osuosl.org (Postfix) with ESMTP id 186A11D9 for ; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 0A33C80972 for ; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id syn277v_jD5r for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp1.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp1.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=PBD4tzUE Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp1.osuosl.org (Postfix) with ESMTPS id B039580D73 for ; Tue, 1 Sep 2026 15:49:27 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 3FD7A84A30; Tue, 1 Sep 2026 17:49:18 +0200 (CEST) Received: from PA5P264CU001.outbound.protection.outlook.com (mail-francecentralazlp170100000.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id D3E0A83EEF for ; Tue, 1 Sep 2026 17:49:05 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="PBD4tzUE"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=onAPsmsqFY39sIUnJFohGG4XeThwmr7TvpAT5+rrhk5J+14/G0hqIgLOGcDJlZaY7sdjlwuFIE0ojkC9498M4x/Ysk0cuT3ImSMt29M50ZQRYTaj3+lApWV/Yq7vG96JhM4miy6qjVhoV3J5dJzioMXLuHdOAAcZG+Y4JcYDInNWJjcsj7KTaizibkw/pLqe5ahnl8TNEQuwdaU2nwn+VJhJcAZoU+QT5oG+B4dcOH0U3SaeP4IdwQ1KScUJgzQDu+9/K8RsmYIaLcQiT38Dc4QWziCTLs1840z0TFM6b9wPio2vdbcj3B2oMjfPGPfJ70kZmoXBoiYOoy/eGwK/hw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=K6FPFqFaCxxEnT3g2ero1OSTFNY0NYcEKpvmBbOnKao=; b=GUo6OugWbKBDb5nhMeswUFB5M5yBlQLz/uY7/htF9mJi1oGGYw8UNaba/R29qUzgDQHUwwm/ysOkv6Mm9w5CWNEZ+VQPFl/g0j9fl7LmOvLuL+li+cpWXa6mTllhqJJqpexc1rRYlToYLvXj1Y+3UhneWGaEUM8TJcgCaW8J1iCZA5GPeJhahlofgN7oO9o91ch7XDqjGbXFwipw2tSHxzBVL52jexsBWoGUd2o/i1xY8lEhMnUUeTu6sSFlMoU1zjhTeeU0ivW89h+w/qQTJqjb9/HogILew8oiFxlCewvNpFq9lOY8af3gtlLfr6XNYbbEIEbQPwwSiMwKL38Jbw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K6FPFqFaCxxEnT3g2ero1OSTFNY0NYcEKpvmBbOnKao=; b=PBD4tzUE4xP/ZKAf2bA9vSp6T0dLawOY0yWLsY0PmvcqTYWUtf5WaaFdwuISc1eHl4FrmryXLMFEjrVh/5KR/EiJOH2rRdnidu6+X/z0xxCj+i+tfyAl5pnjG9SpNtrU49JTssHggPtXnV6KsJJNGbVvYhrCXg/p9p/3K0j2l4NxDgWxyUjrq+JJ+HPwDhJ451qetdX/0YdAy9r1JmbyNhhD++lQ5ba1UNHc5qKVc5Vum4lhLuS6ayiL4nrtuh3UbH4GnHMvnOTHYxDIHJmYZeoj9YlaS6i1LwIzhm4d5lcoDUrcreAGm3cTVDeciqNvzLgMkRF5W/fxtLhLmWgAbw== Received: from PR1P264CA0106.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2cf::13) by PASP264MB5171.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:436::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA3PEPF000089B8.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2cf:cafe::8) by PR1P264CA0106.outlook.office365.com (2603:10a6:102:2cf::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.10 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA3PEPF000089B8.mail.protection.outlook.com (10.167.242.20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:52 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id CAF492024F; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 08/15] test: vboot: add test for ecdsa Date: Tue, 1 Sep 2026 17:48:37 +0200 Message-ID: <20260901154845.102123-9-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA3PEPF000089B8:EE_|PASP264MB5171:EE_ X-MS-Office365-Filtering-Correlation-Id: 4d4e7647-7c28-4bca-d54d-08df08408611 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|376014|23010399003|36860700016|82310400026|6133799003|56012099006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: Ewibuz1Cx9cYudopu+7cWTUl0dLGlE7d0gnvLcTvkxzeaz9nYsLhtkfSsdDPInf+hE3717OVOs/dl294gTAboG5ebkV3i8OrvpA16/pt/jayTPSbnziKLW2Q64ucNstwxXnR5TXwDvHfh1owZcW5lDjgEndU14qm/DsEwIBv05WxxHf0uNJyktaQzqVvSX0WGbSL4bLT3B/BfrZAl79i1cRWkzzQeQyD3Xi0hWyby4eecb9dFCJ5P489uUWrKULENWeCY5ZdAR8s8c6oKRKlQJd2lTeVSG8Kt0O4TeYEzkeNzK/pF6EmiITsDTv07D5Br0UdLsiAn1n4Vg4gS2DEwluRQwCOAcy42G9DkkSA9Hm3NhQK6bG1UiToV4eocVJKaRE98wOrXTEGfkHrw4idGR51AUPs2/G3qy6dsMr2sKX46fqGweQ5BgqjIUT3gtQjA2308GFYQXVg6igRfi14pYdUM15Jy3yNxZ1sBYm1f+qNJdChBBoGJGwN3nNn/fSIny8OMF/46Ll1S7PNDKzgVX8ABuEWiqGD61rKrDyV+OXR2wm49GO6gE+lJp+3RiEUNQY6Ha/z92yVRJTz9Z2MchyMIN2/6Wzq7ENXZwf/RDfX8jR+2bxoUbsLfo/0kYOIVxjhJ9jGxFidhxEeOGnNu6ghufxdv547h2QuSd6mJi3hoD6Ewb8XXsMeBX4gDzarE03tl4q6e3NEdmLpPtBl4Q== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(376014)(23010399003)(36860700016)(82310400026)(6133799003)(56012099006)(10067099003)(22082099003)(18002099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: G4CHGNGJDs61P6ZWMkLxydv6iGesuoJ3oJkkCiAyfo/8TavbnfjBV9uHX1PNU9K2b8zzcuctE16E4Ff+HnQKCttvgwRPvdwPvU7Givb7HL8l2cjBWwe1Wey8lFbxakOxbJzFJKR8OiIigfCszKL2bvv8Tseh0Mae+oPh3G5D9Slf87XH1vzyDKkFMSHNeAiNr4vGTVSm+us/vfT2xijVsYbPIosEyIIjRTxKhbUjt+f+uC1lv3aNnYKs7t7WTUvXtYvh9wUoksjzAP/wIn7A5b7fYO2UwYJzB/2SLoqKgdvdhLN2wE18YIpuxibDkq+7P8D9lv8sBa0nLS/wKqjiUw6S3H6+0jO1tLbZd9qwAWUG/hzJp5VTEXRUSuSMcBq6Ei225EUwl3ykZoFbJzHTj3H9KmzMiErnXdmhBvG/l8dzcxjrygE5DACTXG2tZbBl X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:52.9673 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4d4e7647-7c28-4bca-d54d-08df08408611 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA3PEPF000089B8.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PASP264MB5171 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org This commit adds test case for ecdsa on fit, but not (yet) for the global image signature (preload). Reviewed-by: Simon Glass Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v2: - initial version v3: - no change v4: - no change v5: - no change v6: - no change v7: - no change v8: - no change v9: - some minor changes to fix rebase on next test/py/tests/test_vboot.py | 29 ++++++++++++ .../vboot/sign-configs-sha256-ecdsa256.its | 44 +++++++++++++++++++ .../vboot/sign-configs-sha256-ecdsa384.its | 44 +++++++++++++++++++ .../vboot/sign-configs-sha256-ecdsa521.its | 44 +++++++++++++++++++ .../vboot/sign-images-sha256-ecdsa256.its | 42 ++++++++++++++++++ .../vboot/sign-images-sha256-ecdsa384.its | 42 ++++++++++++++++++ .../vboot/sign-images-sha256-ecdsa521.its | 42 ++++++++++++++++++ 7 files changed, 287 insertions(+) create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa256.its create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa384.its create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa521.its create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa256.its create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa384.its create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa521.its diff --git a/test/py/tests/test_vboot.py b/test/py/tests/test_vboot.py index 33cbcea5c24..89876ff030a 100644 --- a/test/py/tests/test_vboot.py +++ b/test/py/tests/test_vboot.py @@ -94,6 +94,9 @@ TESTDATA_IN = [ ['sha256-pss-pad', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', False, False, False, False], ['sha256-pss-required', 'sha256', '-rsa2048', '-pss', None, True, False, False, False], ['sha256-pss-pad-required', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', True, True, False, False], + ['sha256-basic-ecdsa256', 'sha256', '-ecdsa256', '', None, False, False, False, False], + ['sha256-basic-ecdsa384', 'sha256', '-ecdsa384', '', None, False, False, False, False], + ['sha256-basic-ecdsa521', 'sha256', '-ecdsa521', '', None, False, False, False, False], ['sha384-basic', 'sha384', '-rsa3072', '', None, False, False, False, False], ['sha384-pad', 'sha384', '-rsa3072', '', '-E -p 0x10000', False, False, False, False], ['algo-arg', 'algo-arg', '', '', '-o sha256,rsa2048', False, False, True, False], @@ -287,6 +290,29 @@ def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required, utils.run_and_log(ubman, 'openssl req -batch -new -x509 -key %s%s.key ' '-out %s%s.crt' % (tmpdir, name, tmpdir, name)) + def create_ecdsa_pair(name): + """Generate a new ECDSA key pair + + Args: + name: Name of the key (e.g. 'dev') + """ + + if sig_algo == "-ecdsa256": + curve_name = "secp256r1" + elif sig_algo == "-ecdsa384": + curve_name = "secp384r1" + elif sig_algo == "-ecdsa521": + curve_name = "secp521r1" + else: + curve_name = "unknownCurve" + + utils.run_and_log(ubman, 'openssl ecparam -name %s -genkey -noout -out %s%s.pem' % + (curve_name, tmpdir, name)) + + # Create a certificate containing the public key + utils.run_and_log(ubman, 'openssl req -batch -new -x509 -key %s%s.pem ' + '-out %s%s.crt' % (tmpdir, name, tmpdir, name)) + def test_with_algo(sha_algo, sig_algo, padding, sign_options): """Test verified boot with the given hash algorithm. @@ -570,6 +596,9 @@ def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required, if sig_algo == "-rsa2048" or sig_algo == "-rsa3072" or sig_algo == "": create_rsa_pair('dev') create_rsa_pair('prod') + elif sig_algo == "-ecdsa256" or sig_algo == "-ecdsa384" or sig_algo == "-ecdsa521": + create_ecdsa_pair('dev') + create_ecdsa_pair('prod') # Create a number kernel image with zeroes with open('%stest-kernel.bin' % tmpdir, 'wb') as fd: diff --git a/test/py/tests/vboot/sign-configs-sha256-ecdsa256.its b/test/py/tests/vboot/sign-configs-sha256-ecdsa256.its new file mode 100644 index 00000000000..6bd291a40c2 --- /dev/null +++ b/test/py/tests/vboot/sign-configs-sha256-ecdsa256.its @@ -0,0 +1,44 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + hash-1 { + algo = "sha256"; + }; + }; + fdt-1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + hash-1 { + algo = "sha256"; + }; + }; + }; + configurations { + default = "conf-1"; + conf-1 { + kernel = "kernel"; + fdt = "fdt-1"; + signature { + algo = "sha256,ecdsa256"; + key-name-hint = "dev"; + }; + }; + }; +}; diff --git a/test/py/tests/vboot/sign-configs-sha256-ecdsa384.its b/test/py/tests/vboot/sign-configs-sha256-ecdsa384.its new file mode 100644 index 00000000000..68c482acff2 --- /dev/null +++ b/test/py/tests/vboot/sign-configs-sha256-ecdsa384.its @@ -0,0 +1,44 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + hash-1 { + algo = "sha256"; + }; + }; + fdt-1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + hash-1 { + algo = "sha256"; + }; + }; + }; + configurations { + default = "conf-1"; + conf-1 { + kernel = "kernel"; + fdt = "fdt-1"; + signature { + algo = "sha256,ecdsa384"; + key-name-hint = "dev"; + }; + }; + }; +}; diff --git a/test/py/tests/vboot/sign-configs-sha256-ecdsa521.its b/test/py/tests/vboot/sign-configs-sha256-ecdsa521.its new file mode 100644 index 00000000000..f673accd39a --- /dev/null +++ b/test/py/tests/vboot/sign-configs-sha256-ecdsa521.its @@ -0,0 +1,44 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + hash-1 { + algo = "sha256"; + }; + }; + fdt-1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + hash-1 { + algo = "sha256"; + }; + }; + }; + configurations { + default = "conf-1"; + conf-1 { + kernel = "kernel"; + fdt = "fdt-1"; + signature { + algo = "sha256,ecdsa521"; + key-name-hint = "dev"; + }; + }; + }; +}; diff --git a/test/py/tests/vboot/sign-images-sha256-ecdsa256.its b/test/py/tests/vboot/sign-images-sha256-ecdsa256.its new file mode 100644 index 00000000000..009003bb601 --- /dev/null +++ b/test/py/tests/vboot/sign-images-sha256-ecdsa256.its @@ -0,0 +1,42 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + signature { + algo = "sha256,ecdsa256"; + key-name-hint = "dev"; + }; + }; + fdt-1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + signature { + algo = "sha256,ecdsa256"; + key-name-hint = "dev"; + }; + }; + }; + configurations { + default = "conf-1"; + conf-1 { + kernel = "kernel"; + fdt = "fdt-1"; + }; + }; +}; diff --git a/test/py/tests/vboot/sign-images-sha256-ecdsa384.its b/test/py/tests/vboot/sign-images-sha256-ecdsa384.its new file mode 100644 index 00000000000..567de687a06 --- /dev/null +++ b/test/py/tests/vboot/sign-images-sha256-ecdsa384.its @@ -0,0 +1,42 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + signature { + algo = "sha256,ecdsa384"; + key-name-hint = "dev"; + }; + }; + fdt-1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + signature { + algo = "sha256,ecdsa384"; + key-name-hint = "dev"; + }; + }; + }; + configurations { + default = "conf-1"; + conf-1 { + kernel = "kernel"; + fdt = "fdt-1"; + }; + }; +}; diff --git a/test/py/tests/vboot/sign-images-sha256-ecdsa521.its b/test/py/tests/vboot/sign-images-sha256-ecdsa521.its new file mode 100644 index 00000000000..74ed45b21b8 --- /dev/null +++ b/test/py/tests/vboot/sign-images-sha256-ecdsa521.its @@ -0,0 +1,42 @@ +/dts-v1/; + +/ { + description = "Chrome OS kernel image with one or more FDT blobs"; + #address-cells = <1>; + + images { + kernel { + data = /incbin/("test-kernel.bin"); + type = "kernel_noload"; + arch = "sandbox"; + os = "linux"; + compression = "none"; + load = <0x4>; + entry = <0x8>; + kernel-version = <1>; + signature { + algo = "sha256,ecdsa521"; + key-name-hint = "dev"; + }; + }; + fdt-1 { + description = "snow"; + data = /incbin/("sandbox-kernel.dtb"); + type = "flat_dt"; + arch = "sandbox"; + compression = "none"; + fdt-version = <1>; + signature { + algo = "sha256,ecdsa521"; + key-name-hint = "dev"; + }; + }; + }; + configurations { + default = "conf-1"; + conf-1 { + kernel = "kernel"; + fdt = "fdt-1"; + }; + }; +}; From patchwork Tue Sep 1 15:48:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296084 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=ej4JLreD; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=KXEk7VTx; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KF3xy4z1xwZ for ; Wed, 02 Sep 2026 01:49:37 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 721DC60794; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id PAh2mghNjnbB; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277772; bh=n2Hah7R7PHu6UwQFEGDJLv5laxPOvP81vayzFjcPWcM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=ej4JLreDJGDRAx55pcF2Gd0N+iHXfp1c6Y/q+YKBpPohar711jZCUCLUBsJQyN3xH HCCCquDIc1kKQYm8oh9Wjmfj18F7deTsH3UBRtrEUfCs7Zmz3p8eNTsos2dNvj91Xp EwEmQtqnlicdoIY2yKB10roRn2vhbwbW/vp/tYSokwOtZnmxDX/198y4ktR7DYh4c5 OjW4ZDNlMWteSz0QjHWKQRJpIYmNpdMJjTizkttj6O0r2M/In2iTXDLUSbk5B4UmfY WVNxJXVfwXwZaWOA6NwcoaGuAHgZNjfbt76ptoEyEdi6tPj8TgOsIlc4NyBkiNqkXO ppNrPfbe1YL2A== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id BA196607A1; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists1.osuosl.org (Postfix) with ESMTP id CFA75E45 for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id B61286076B for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id AgOFIn6_jd9p for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp3.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=KXEk7VTx Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) by smtp3.osuosl.org (Postfix) with ESMTPS id BCE4060766 for ; Tue, 1 Sep 2026 15:49:28 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id DBC3A84A48; Tue, 1 Sep 2026 17:49:22 +0200 (CEST) Received: from MRZP264CU002.outbound.protection.outlook.com (mail-francesouthazlp170100001.outbound.protection.outlook.com [IPv6:2a01:111:f403:c207::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E36C484994 for ; Tue, 1 Sep 2026 17:48:59 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="KXEk7VTx"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lrZ8NIhJdhoX3jcGDf3MCoI0fKparl+Vlu07SNgDvm5w7VF079wzvd9Vt/gEf46AYNNMDjtwjLJeEr+QKHIu1eg0d8duMsDKk1mAp+k2vXAkUDSGwkAMzO5NvhnqINT0aRGYAtl+RS0GfIUai5miH2O18zdamTm8jQhTpAL3WRhONybg/XCLVbhLxrk1Qarlf4JCAQ3sZqbBeITb4UyLxSWQ5UzXD5kaFzwGC4foXhsGgCLBG1+rk/5VQqv0jqhKdYA/TW2PBwRoYGqHi4BrDXksE6I6V6rnocfW+8OJvjoZb5bxePGh4Hwfqe+0qUuwgMYm2n6z1vWiivwGnPiZaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=n2Hah7R7PHu6UwQFEGDJLv5laxPOvP81vayzFjcPWcM=; b=g+tUeIy/4jY5tzJUDpf8iewmzp//vmGPhI9Vp70WLERAjy7xTuXjXq6meEFtXGhHCNmOVwPHS+kJSpjRIvQyO25jVCJgIn6lB16kBN7UmqGHkNVJk3SwTuMhv/kTxiKgbW35p1RQNBLp44ggUS+pUr4uCj+ptATHe8+vDnz6G/qyxtJRB8qOV18i14ZELGj4OUP/1Q8LvUo30GFuzYBgUThpJCnLxSDAZhucMYf9ib9flgyOItvMRcEpCf+RpY+hjsbZm4i3WPx2xNXtiUwMoFTNM8GsH3VDm2zH8wxo6XBMrdSdjaLOMGLEzhGPLTb9eZX4nG75q+Rqqp8DkIMF7w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=n2Hah7R7PHu6UwQFEGDJLv5laxPOvP81vayzFjcPWcM=; b=KXEk7VTxPut+GZUucOtLwBdT3wpyPj5n2mvOacW3SN9ceHiW4dCIZWLr6Tw6HzREUDUgX7S5wGpBBipOZ5jLBTLTH5+BVfIrggt92cbJR/F7edjuJbULx5H4Zgf5OsPxIhCVCDiwE1/yCcS1KPLKmLW78LUPEUzEhoezPOCpqs6T6ZjQ4T3xFsc3OUorTWRXSH4Fx3kNn/iJY4wLf/s5Cy9Wq98CeN/St3crCM1gIyGYlBRECafqKu8qXQvz9hxNaN22XQCbUGpjKkvfn7A9RI8FnJ6xWkXNy3ic7Vt+0vPoyZHpCl7ifzlW48yji/JGdNf/mEqiOBcSHa9gk4nipw== Received: from PR3P193CA0059.EURP193.PROD.OUTLOOK.COM (2603:10a6:102:51::34) by MR1P264MB3473.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:23::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA3PEPF000089BA.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:51:cafe::26) by PR3P193CA0059.outlook.office365.com (2603:10a6:102:51::34) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA3PEPF000089BA.mail.protection.outlook.com (10.167.242.22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id E4FAA1FEAF; Tue, 1 Sep 2026 17:48:52 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 09/15] tools: fit_image_setup_sig: set required_keynode to -1 Date: Tue, 1 Sep 2026 17:48:38 +0200 Message-ID: <20260901154845.102123-10-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA3PEPF000089BA:EE_|MR1P264MB3473:EE_ X-MS-Office365-Filtering-Correlation-Id: 274ac77d-db9d-4691-b893-08df08408620 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|82310400026|1800799024|376014|23010399003|36860700016|6133799003|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: CVPTzPo1xNH3+ihue1R48Oh2rAE/qPj+kcxPgfnvL2bdanaRMmsJaYRrMhukPlYD1o2Qg7DqaG8odOzWJ2QHGax6eb79KAy9TyJNSMDwNTri45zYFaw385k8+Y8vFT1I9rij45kNA+XSx+RqHJ/fCzsujfLTeMA5c9nR4I7UcmQOQvv8B3AO6rFvOh/NHjh0yBnt1AVnFqu2JCMu9SXi+mHzYw/NTNvtOT6JwK2lIKnwEr3jzKOwYnDiuobbo6sm5jGew1+nkzkYRbhhFjdPLJMPXy/k2uyuhlwKo8y9jZ+KO/nSUKhK4xzzGIGkeyV0zyCxF074AnUnRDHOHEQw1K1jp3reLGoWTAAGjVfnwIAgCX/V3z0DfbsFBF8d1bvsyshoNa6Rmpy6LJz3v2S3sBUennOhCSwCsLb7Vxl2jjJBtN0SfqsLOV+OF6mRZprVvXrQOcjSJLyAKreRV1636C2sLKgd62cqp/ynR/eFd+C66d1mPjNZlzCpSD7N85Zv8KL8HyPBe1FAOOLkFcnoocLfJgS5ZioX3pnCrmlLsoQs4ujbn80pfAbjH5RY60yUb7KGYQm2hAS8h+cnzGgubDuZtPyOjYQ6HWeRITUp3Y2uDFnQm++0G89aYBgOeIKPof0LicNGjYY0zyQQGQqdSH4isAQ9pYnH16MAD5bj+1r+Cp+t/NrVhTWSWRSTVoveXyIbjiARR7ihmqtHqv07Pg== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(82310400026)(1800799024)(376014)(23010399003)(36860700016)(6133799003)(10067099003)(56012099006)(22082099003)(18002099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ST1l5GdtrcBlCXDBZxOcdW1x8oHVahaLNzrW1axR2OcpM48699ipl8w9pDm8TXACJiBNhwg3NyZwg/GT/IrslqxISyMjMhqEonLHS1ldmAfrwKAuabhjjtNATia1hFMYsKXUTccvHc2ppz/FN1ANnQ7v4GV2Gyvd6yu9MJxxFkoe3qdnlYbg40tLyHC6yYLuMCON/w44B0CzGgJO65orKdOBz5ajlUXh67B6aC4C4WC/ay6rqV65rKByykb2QrOY2HmI5FKzgjScJoRT8m+v1CCoPqq3Ineqn2AVSPue6WTkDlGCVihB72lEiBIjAAg+A06WaBJ6kzq/atgDdhUSDuxMxnbSCjG8z+G2ZPp3eYYohRy0tdFDpFRtdsWfhGFuQyePHU6lFO4kbCVmuKw3V1oNco8kDpZk5bakVO16GUZwBvkDJqvQkYLjFjlBzhfz X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:53.0607 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 274ac77d-db9d-4691-b893-08df08408620 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA3PEPF000089BA.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MR1P264MB3473 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org When initializing info about a signature, set required_keynode to -1 instead of 0, as 0 is a valid keynode offset. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v5: - initial version v6: - no change v7: - change info->required_keynode > 0 to info->required_keynode >= 0 in ecdsa_verify_hash v8: - no change v9: - no change lib/ecdsa/ecdsa-verify.c | 2 +- tools/image-host.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/ecdsa/ecdsa-verify.c b/lib/ecdsa/ecdsa-verify.c index 494b60b4ab0..341486de2d3 100644 --- a/lib/ecdsa/ecdsa-verify.c +++ b/lib/ecdsa/ecdsa-verify.c @@ -117,7 +117,7 @@ static int ecdsa_verify_hash(struct udevice *dev, if (!ops || !ops->verify) return -ENODEV; - if (info->required_keynode > 0) { + if (info->required_keynode >= 0) { ret = fdt_get_key(&key, info->fdt_blob, info->required_keynode); if (ret < 0) return ret; diff --git a/tools/image-host.c b/tools/image-host.c index 46036673050..9a85a3dda2f 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -202,6 +202,7 @@ static int fit_image_setup_sig(struct image_sign_info *info, info->checksum = image_get_checksum_algo(algo_name); info->crypto = image_get_crypto_algo(algo_name); info->padding = image_get_padding_algo(padding_name); + info->required_keynode = -1; info->require_keys = require_keys; info->engine_id = engine_id; if (!info->checksum || !info->crypto) { From patchwork Tue Sep 1 15:48:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296094 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=Ol3FIA1u; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=oeKxcuTd; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9Kg2GS5z1xwZ for ; Wed, 02 Sep 2026 01:49:59 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id E5D486084D; Tue, 1 Sep 2026 15:49:57 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 209I1AZ1fUde; Tue, 1 Sep 2026 15:49:54 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277788; bh=g0QyAAGd1tslXVrOf/99d8Ttc2DPV++F2mLgjm/Zq24=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=Ol3FIA1u785vZnsa77MK2MhQYoQs0dSk4FzQNs+eXoEKWIqSSXnfo2qx0MNbW6IyH ps2jBTmxp4RkkuOPmkOrK5AjWIWUvH5UYbM7tbbCLP6cVkOk2DYheCf0lKU3f+PSTJ EIO1FSiagh6uNEu/ipty26WnQz60veNvML+cqNIiAkCu58v8Tr2OXgq+0AMnblxim2 6IrJKYKDV95+oTdGAbFxXW8k8yIleXs9aGlqvRFgKJstyLbMvizJGvJAzI2Lv5Ah2t j6f63wIn0eqNdvcEHe2/kKhTKd8Uquc2yvQLBoGRUA/B8RZf0HJ0x64Xob3dMFtoCf VzARPP1PCvEvg== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id 160ED60801; Tue, 1 Sep 2026 15:49:48 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists1.osuosl.org (Postfix) with ESMTP id 92F831D9 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 786E6400C1 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id i0TAQae28eKs for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=oeKxcuTd Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) by smtp2.osuosl.org (Postfix) with ESMTPS id 48CDA40213 for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 7CAA984659; Tue, 1 Sep 2026 17:49:29 +0200 (CEST) Received: from PAUP264CU001.outbound.protection.outlook.com (mail-francecentralazlp170110002.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E4F94849AA for ; Tue, 1 Sep 2026 17:49:00 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="oeKxcuTd"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tq6dMILRNuO0W0m6Qisi1PEwelmha7GbR/7VsPFn93xODgxTwJz2aG/vRJMOSGDDh45QDffhUPdByJVyHAIPkQLSWRUGTLSmC2ST0qBfU1izwqkAE9VrKe6UTIjL46QvM+K09cEzI3EOW1K2K/1r+BzVa6T7V1Qoz1AwCxiMdgFLWasD+Ls+l2/1y7DHxBdpiVeSzzhsPzGEMiHM19U227M7V0pK5irlC8N11rUJgs2ueKuM+gYfU8Uik9VIQqKISffzi0M+Auoncia5XgVdXeFkwyL1RapFbwPWPM6MsTrkil8db5mdn5Voiqii11YYZwuaHRrKgLM9xPAJIKtzeQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=g0QyAAGd1tslXVrOf/99d8Ttc2DPV++F2mLgjm/Zq24=; b=k4ToJ9DAvgcRo5EpWl4h+7zzDUQAOafY4fnyg0C+RWlgbqnLe2ue/1wAqqEhs+GoSOL3AFduuOXPnCBCp+rhZ4bWsGQxxLCTfkJqUPs4wedT6glDLI9yRlXVstVV+SAreWbdMxQWMGNeoBO2on+S+HDxADJCWRRoHRJ1IEJCOC6h+dVIzWPFFXrApjwCjq+v0hbKQPWOuHFxKhqh4bIqlmNQxBQJU5HoOq5y1nDAoEG/ZfHhwOXUIW5vixYbGpBdutljTvW9G7q8ln6RkUo+o2AkaD+MYEjJn9BLm9Aoh+Mc6gj+TOTZqCHyKn80Aw3v/QmsuBeXrDhtOg2lqkLTbw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=g0QyAAGd1tslXVrOf/99d8Ttc2DPV++F2mLgjm/Zq24=; b=oeKxcuTdQnFCGScITOBISqzlruYNX3m0fJlfSlKADjzhIowNsgGOq3wVh9yFzlohQ7F0U5IUrAlq9B4GAkKMb9o/ouzt5xoMkQ6hSucmsKWuxXqAYZFDRdmdQuxqcTXqMZc4Zn3EANTzRnFYatzIAGLf8y8LASZLJcyS2sw4Cf6CH1z5X1fDHDQUlOeAZna+ZW6puaXtt+hwyzswhIJDwFoUyW9iCI3/YxZooZ4PzR0gXa1dDm/XRYu8sBAzodOA/KX1W7nLkIvl5+tw5LXsJeCfmkBmBqCNiiDSpt/wTugUCI52ninOj6ErKcpW2b/4gR1ojkXFNUErk9px4vmeuA== Received: from PAZP264CA0003.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:21::8) by MR0P264MB4813.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:64::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA3PEPF000089BB.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:21:cafe::69) by PAZP264CA0003.outlook.office365.com (2603:10a6:102:21::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA3PEPF000089BB.mail.protection.outlook.com (10.167.242.23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 05BE72000D; Tue, 1 Sep 2026 17:48:53 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 10/15] tools: mkimage: pre-load: add support of ecdsa Date: Tue, 1 Sep 2026 17:48:39 +0200 Message-ID: <20260901154845.102123-11-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA3PEPF000089BB:EE_|MR0P264MB4813:EE_ X-MS-Office365-Filtering-Correlation-Id: 13079165-2550-4f46-5440-08df0840862e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|82310400026|23010399003|36860700016|376014|10067099003|6133799003|3023799007|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: gWClhfapkyP2XpLgXcSJ8p4n/KL1DSywhPb3mFD7hhT4c6xEH/LZQwZM47c+LS8ohbvI4HPGVD0yjLZaVjf5qDiGyN2ZDYd8AmR7iiJV5zc8c16NpGL4Q2KH5Y7C+Ix+ENAk9lXMa9vQi+x6yDyyX2UOeVOzub6am2wN5sWMYQmrW225PHZIN5O5bWRIWx60FFy5WkXtA5wgQDUjwcDU3wVpgh/dVQPTiC+LKe2q+cgT30UHni5Ahqfttd3ukzgfKVvcH2Se/pPLiIHgxKCJNpccjZ95NsAZIH+qdvAc/q97QKm75SCcBTObYkgqF6oKEN2gTAbwERnYNri3JWsEFmX5L3Qi9q7Nz48ge8KxH3L1VYqnfmwsopU8fAAGzuoz2NSxbPGDofv20yzh9pc+JAjQb478tk6K5hp4OvlK3nyXvEcNodrxFYNNeufbY4paib/DmKx9kU+ru7No2I1rRZSPfXXjmpx08IjtwGq/UNtt31x+U3SIfxJqxRMY+WjDZbF60ym+ZlYXX0iyX0v6XVVJ3AYCxMqU3Ht9P0rIZmAU42SthM+e8j+OfQUjrI1OCqpiSXN6kprLPaxRdQYN2SkfrkRcoCjcdZuY96YxGt8VAk+tnbBoP9YiLZXE5GGgV3SraCyP2V2CFJ9/GlA9kFFNlpOvibdmFf8Dv4A5eE+wCyuYh9ZmBBbMbYGZDJcx6SUW01ctwFGbWpr1dSS1VQ== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(82310400026)(23010399003)(36860700016)(376014)(10067099003)(6133799003)(3023799007)(22082099003)(18002099003)(56012099006); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Qdki7r4a9o+yWXDHdku1DFvcVD1YKzMLLhnQ5I/xwdSYU2dAc4DYbeleg7qGLy3EPEtk69i9FJLj3syKHtgHFySZhbAyN716p1zzEb1JkOwN4hxS+quYiGqjkw6F3w2EWZrfHt1U4r9/c4x9pxIAIj/2ippy0i2V4+4N0OddiJ8EyYW7ZsG7bkMkCUwMgJ4n1dbH8W7OYDn2sJJl8FA9Aijg9Wa446rDGzHTevaA4bQ7KtpZXOtj2r7mtWfuA8ouOPaCHHfVp/nvNYQlhAwCjimcc8D4EJim2cNrI6hoOqTstR7JFWvjEJNDK97y/wMDx6BpILF5t8wVPolOtxzCdobwrI17Q/j2u3GiRqsJLWf5Pu7YLgZP1KU8cnkSH02GLWT62LH8Jq9lb19FtTBS0I7AiTt2OiPRGEtwN4LOeULo8xSOP3Jy61noOjJC1Eei X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:53.1474 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 13079165-2550-4f46-5440-08df0840862e X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA3PEPF000089BB.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MR0P264MB4813 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Right now, mkimage can only create pre-load header using rsa. We add the support of ecdsa. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v3: - initial version v4: - use pre_load_noffset (do not compute it again) - release memory allocated with strdup - clean code v5: - check checksum and algo before using them v6: - no change v7: - no change v8: - no change v9: - no change lib/ecdsa/ecdsa-libcrypto.c | 29 +++++++++--- tools/image-host.c | 92 ++++++++++++++++++++++++++++++++----- 2 files changed, 103 insertions(+), 18 deletions(-) diff --git a/lib/ecdsa/ecdsa-libcrypto.c b/lib/ecdsa/ecdsa-libcrypto.c index b3fc75fac48..5e69782424c 100644 --- a/lib/ecdsa/ecdsa-libcrypto.c +++ b/lib/ecdsa/ecdsa-libcrypto.c @@ -517,14 +517,9 @@ int ecdsa_verify(struct image_sign_info *info, return ret; } -static int do_add(struct signer *ctx, void *fdt, const char *key_node_name, - struct image_sign_info *info) +static int search_key_node(void *fdt, const char *key_node_name) { - int signature_node, key_node, ret, key_bits; - const char *curve_name; - const EC_GROUP *group; - const EC_POINT *point; - BIGNUM *x, *y; + int signature_node, key_node; signature_node = fdt_subnode_offset(fdt, 0, FIT_SIG_NODENAME); if (signature_node == -FDT_ERR_NOTFOUND) { @@ -559,6 +554,26 @@ static int do_add(struct signer *ctx, void *fdt, const char *key_node_name, return key_node; } + return key_node; +} + +static int do_add(struct signer *ctx, void *fdt, const char *key_node_name, + struct image_sign_info *info) +{ + int key_node, ret, key_bits; + const char *curve_name; + const EC_GROUP *group; + const EC_POINT *point; + BIGNUM *x, *y; + + if (info->required_keynode >= 0) { + key_node = info->required_keynode; + } else { + key_node = search_key_node(fdt, key_node_name); + if (key_node < 0) + return key_node; + } + group = EC_KEY_get0_group(ctx->ecdsa_key); key_bits = EC_GROUP_order_bits(group); curve_name = OBJ_nid2sn(EC_GROUP_get_curve_name(group)); diff --git a/tools/image-host.c b/tools/image-host.c index 9a85a3dda2f..ed1bfe68a31 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include @@ -1681,13 +1682,74 @@ err_cert: return ret; } +static int fit_pre_load_data_key_rsa(const char *keydir, void *keydest, + int pre_load_noffset, const void *key_name) +{ + unsigned char *pubkey = NULL; + int ret, pubkey_len; + + /* Read public key */ + ret = read_pub_key(keydir, key_name, &pubkey, &pubkey_len); + if (ret < 0) + goto out; + + /* Add the public key to the device tree */ + ret = fdt_setprop(keydest, pre_load_noffset, "public-key", + pubkey, pubkey_len); + if (ret) + fprintf(stderr, "Can't set public-key in node %s (ret = %d)\n", + IMAGE_PRE_LOAD_PATH, ret); + out: + return ret; +} + +static int fit_pre_load_data_key_ecdsa(const char *keydir, void *keydest, + int pre_load_noffset, const void *key_name, + const void *algo_name) +{ + struct image_sign_info info; + int node, ret = 0; + + memset(&info, 0, sizeof(info)); + info.keydir = keydir; + info.keyname = strdup(key_name); + info.name = strdup(algo_name); + info.checksum = image_get_checksum_algo(algo_name); + if (!info.checksum) { + fprintf(stderr, "Can't find valid checksum from %s\n", + (char *)algo_name); + ret = -EINVAL; + goto out; + } + info.crypto = image_get_crypto_algo(algo_name); + if (!info.crypto) { + fprintf(stderr, "Can't find valid crypto from %s\n", + (char *)algo_name); + ret = -EINVAL; + goto out; + } + info.required_keynode = pre_load_noffset; + + node = ecdsa_add_verify_data(&info, keydest); + if (node < 0) { + fprintf(stderr, "Can't add verify data: err = %d\n", node); + ret = -EIO; + } + + out: + free((void *)info.keyname); + free((void *)info.name); + + return ret; +} + int fit_pre_load_data(const char *keydir, void *keydest, void *fit) { int pre_load_noffset; const void *algo_name; const void *key_name; - unsigned char *pubkey = NULL; - int ret, pubkey_len; + char *name; + int ret; if (!keydir || !keydest || !fit) return 0; @@ -1714,17 +1776,25 @@ int fit_pre_load_data(const char *keydir, void *keydest, void *fit) goto out; } - /* Read public key */ - ret = read_pub_key(keydir, key_name, &pubkey, &pubkey_len); - if (ret < 0) + /* Is it a RSA or an ECDSA key */ + name = strchr((const char *)algo_name, ','); + if (!name) { + fprintf(stderr, "The name of the algo is invalid: %s\n", + (char *)algo_name); + ret = -EINVAL; goto out; + } + name += 1; - /* Add the public key to the device tree */ - ret = fdt_setprop(keydest, pre_load_noffset, "public-key", - pubkey, pubkey_len); - if (ret) - fprintf(stderr, "Can't set public-key in node %s (ret = %d)\n", - IMAGE_PRE_LOAD_PATH, ret); + if (!strncmp(name, "rsa", 3)) { + ret = fit_pre_load_data_key_rsa(keydir, keydest, pre_load_noffset, key_name); + } else if (!strncmp(name, "ecdsa", 5)) { + ret = fit_pre_load_data_key_ecdsa(keydir, keydest, pre_load_noffset, + key_name, algo_name); + } else { + fprintf(stderr, "The algo %s is not supported\n", (char *)algo_name); + ret = -EINVAL; + } out: return ret; From patchwork Tue Sep 1 15:48:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296090 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=ZjfMmO7p; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=Q7HCaEpp; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KW3r7Lz1xwZ for ; Wed, 02 Sep 2026 01:49:51 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 23C286080F; Tue, 1 Sep 2026 15:49:50 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id qAVIzdgi84rd; Tue, 1 Sep 2026 15:49:47 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277784; bh=cF6Ljpoe5AQ97S+7/CrQZhXMEwtRlGxOUgJFEs0Og/o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=ZjfMmO7pScI56huTfO18jZs4GNclrAoMoxEuyzpRYbuD3nb7PGanPYwWIy1MyIKUh qWe2iPXl/owvMbCoz3ldaHi/SXFL/q0cdEj/xoynO2vMyHU4yjZI758e4uq45Ziun0 8GIhMpFWhCF/7Rno1M4h8wAbx/LHfGvkSwwV9MYDjrB+WshLp55evaM19BR/uvv/UK 8HGqJDtJtyu92y+HT92xBnvTe+yDQ61EFHoN7fm+lGo4lWvBl6Yaji0CIjcDnNikFQ itdVDsGNuaHdjIRcwh4UssWfNAWVkz6K1eBf4Gg9UrHfG5vTOyYX1/AtuBXWXKqkfb KrZeBXUl1GJkg== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id 0E194607E8; Tue, 1 Sep 2026 15:49:44 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists1.osuosl.org (Postfix) with ESMTP id C3633E48 for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id B5D6C401FE for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id pEHOEULg9HDA for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=Q7HCaEpp Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp2.osuosl.org (Postfix) with ESMTPS id 587FF400C1 for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 56A4284949; Tue, 1 Sep 2026 17:49:27 +0200 (CEST) Received: from PA5P264CU001.outbound.protection.outlook.com (mail-francecentralazlp170100000.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id D6640840D8 for ; Tue, 1 Sep 2026 17:48:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="Q7HCaEpp"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bRMdLS5uJn1s3nmG3YWbIi62PeHbCDIRjQII+ZQgmCfFmyrkgtpuUE7XDOtQyaFAS23aPNUFWEABRCYe6yP9Pemc5Kry2MTAq6eG4Ua4YYM0mPmX5e0H1E1S8v+kVXb3fswPF4wwdFJBdMgPnfrxvpvEGSDY0QD1OXVihZcG6WQelPSuN7jm8RK4OGYlL8ujxZ4HAKwF57nNxt8JBgIAQ7ugO1M80jtDud0mgU6pwlsbdgs+kG2Uj3Y1j7Hxfgx8SKRrXvoy3fLs0TR44Gx6g9R1i7hNZoUQmloYXQRQTDofoTQMXcWvBS6v8SaQjgw+lgAxv39BL36IvR3tlbtRWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cF6Ljpoe5AQ97S+7/CrQZhXMEwtRlGxOUgJFEs0Og/o=; b=wj0QXF5NiRuTwP3+9PWO+jwPUdS6P//k0X30cKi51cDVWv20uZXrC8oyvPpq+ntm3UuAMuFM2ZykzzKt651Oeq/8HL9CgMpc8xK0G/8yxpaeJthXyIRZA8GU6UWeGA9hpTiiBIwnnZk28ddf48+EU1U8KeFjiNE878bpZh1KrohXm//KieVRE7VEtZUqwg2qK24RU+QczOtdfK/yFHjJGDPXrJ7A2ZUkBot+z3ONyYiQk/5CvxJWxBK98nOA9r0tRcZuoiFyZ4cCt+80Jqeres7TGpR+PPv9arUNmgZhxYLlXoW2gkxeG8Q4R8HqG7X45P2qA1YGQ/imUk1J6tfVvw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cF6Ljpoe5AQ97S+7/CrQZhXMEwtRlGxOUgJFEs0Og/o=; b=Q7HCaEppURL37QTCSFZGbFrinsOjLRV8F4741MmR5cNVjGHMgMANZyYZeWXzqT6g2PHfl/o5hxcxHijkWdTumgmvGWBK7JDBagCfeB4UkQk62V+iVyXmBSOGiuRk6JzCUL8C8iLYnxv+5pU2No3jeetRqkWyQgw3hjjOpSl9bWFf6tN26rLf+vll0obRf4NkL4SQsbD8dm6bQjC+scMedtZcKUWqi94jFG6foaNMcvocttCNQxIAYaxGpM9+X8IOVnswdQ1zTfWTcaBHgN20RtUQjapTlLV7tMFGGq221FxD2WhEoLlfDHeNTgU8HP84BlfcMTjq1rVzh8VMM7A7Bg== Received: from DB8PR06CA0051.eurprd06.prod.outlook.com (2603:10a6:10:120::25) by PAZP264MB3198.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1e5::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA1PEPF000CC3FB.FRAP264.PROD.OUTLOOK.COM (2603:10a6:10:120:cafe::59) by DB8PR06CA0051.outlook.office365.com (2603:10a6:10:120::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.10 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA1PEPF000CC3FB.mail.protection.outlook.com (10.167.242.6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 1DC2F202C1; Tue, 1 Sep 2026 17:48:53 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 11/15] tools: binman: pre-load: add support of ecdsa Date: Tue, 1 Sep 2026 17:48:40 +0200 Message-ID: <20260901154845.102123-12-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA1PEPF000CC3FB:EE_|PAZP264MB3198:EE_ X-MS-Office365-Filtering-Correlation-Id: 5f06b402-78f4-466f-e111-08df08408641 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|376014|36860700016|23010399003|82310400026|56012099006|10067099003|6133799003|3023799007|17002099007|22082099003|18002099003|4133799003; X-Microsoft-Antispam-Message-Info: DH/Xmsy5xlHxqtLTF2Ulm1/AJWZtkawciPtLjr6Z4+i5ZtMc/+AqyiJZdgBOk4DvI3i74bViKrxmqHHuSOARc+ON5Qe0GiNCroNF5yzDU9uGss1uo1FiKtQouQL0cXyIe9ZHbp3J85K3kq4aZMagKUH62UFgb4LLXaWAP9BX5A0D+FnTt8akKyoTb3/yNrIjghXtgVLTHmWPw6cuinHuX0RWG0dvtcEoX2mSY6hXLNl+kH2ze9V7rhYnbLDQiuJ1G+naRymiCTvE4+wE8EhpV+2nSfC1IFXJ4+3WVH0091Wok9p+fo1QdrJS8U/I2OOO+TaCb+v2ocp/++2KiHtTOizS12HFFaOJcGG3qs+CjxJBkNoUwZCDxyLu4ctA00WTMZh1J9sK+0odRVjeNiQwh9nmpdD3D8e16kKd7yWXhoHdhBjWYidGrRhoZapn3dB4SFMKiCEUDpuCBx6Uaizsg7xaq5NvHNx+A+MZZc/L802enDQYvmwMKaVyIhPqzmrhj40LPD1jkNEwOvZTYR0B2spkrOcTZTNkLLdhAT3K2TmbA7aVgXtyAlDiE17L93/FTPlRvo8bl4Bbk0bs1Tv0DZ8xGEZ4IX9OWe6ta7Q5PRtlAQnNMeGG0jlZ+0iSBo/6+Eei9jVAjVbZtDGtBWOlYNNaT1aTZhKNTi1xCap4s7/JN9Cp+n4YsDwIZXEz/kvd8C6ZO4Ml51hGGyvMUOxQhA== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(376014)(36860700016)(23010399003)(82310400026)(56012099006)(10067099003)(6133799003)(3023799007)(17002099007)(22082099003)(18002099003)(4133799003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 2i28D9soxO03URvU4tK81XfLNXqnBwPSJ6aLDkwtgfo1Ke1xanh3me957zYylwU5kWJ93UOtXB67UifIJJP0q71E5fyM1+de8+AWlLTjbdB27gWUK2T0RUgoIYi6WWs1B9ESLDXDlzFBh3Vul93FfT7VbMfFO7qwzcCazliZhP5U+K/DfPzTIimJVpqSi0IxGkWAObYDVXYB+gEgKv6VSM52tf3H8R1KBBkm+dBmD35B1tQtHQV5WrFsk1yherku/bF9Iz/EqjnF6HNpGiuD/cG5jEhdMeFwKAMMtqR9phRBWxmmbCXvRa8qkC+uJyL9k9BZc6eJoGoTjMXimYun1sOLi8ibu+3aGEPAUCmY5PqTmyTZxJPC2+7L1UiIgPMTZXV8+sBn2m215ivwQYoE/PYXfqAjFiqAetDli0WY4pdltz5yClZFKpHFPpJneTkY X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:53.2772 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 5f06b402-78f4-466f-e111-08df08408641 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA1PEPF000CC3FB.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAZP264MB3198 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Right now, binman can only create pre-load header using rsa. We add the support of ecdsa. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v3: - initial version v4: - merge patch 11 that was adding test for ecdsa pre-load - add key size check - use exc instead of simply e - rename dts filaneme - add a test to check key size v5: - compute ecdsa521 sig instead of using hardcoded value 132 - fix english: don't -> doesn't - avoid line too long v6: - no change v7: - no change v8: - no change v9: - no change tools/binman/etype/pre_load.py | 78 ++++++++++++++++--- tools/binman/ftest.py | 50 ++++++++++++ tools/binman/test/ecdsa521.pem | 7 ++ tools/binman/test/security/pre_load_ecdsa.dts | 22 ++++++ .../security/pre_load_ecdsa_invalid_algo.dts | 22 ++++++ .../security/pre_load_ecdsa_invalid_key.dts | 22 ++++++ .../security/pre_load_ecdsa_invalid_sha.dts | 22 ++++++ 7 files changed, 214 insertions(+), 9 deletions(-) create mode 100644 tools/binman/test/ecdsa521.pem create mode 100644 tools/binman/test/security/pre_load_ecdsa.dts create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_algo.dts create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_key.dts create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_sha.dts diff --git a/tools/binman/etype/pre_load.py b/tools/binman/etype/pre_load.py index 0d953cb258e..7890c1c62a8 100644 --- a/tools/binman/etype/pre_load.py +++ b/tools/binman/etype/pre_load.py @@ -16,8 +16,10 @@ from binman.entry import EntryArg from Cryptodome.Hash import SHA256, SHA384, SHA512 from Cryptodome.PublicKey import RSA +from Cryptodome.PublicKey import ECC from Cryptodome.Signature import pkcs1_15 from Cryptodome.Signature import pss +from Cryptodome.Signature import DSS PRE_LOAD_MAGIC = b'UBSH' @@ -27,6 +29,12 @@ RSAS = { 'rsa4096': 4096 / 8 } +ECDSAS = { + 'ecdsa256': 256 / 8 * 2, + 'ecdsa384': 384 / 8 * 2, + 'ecdsa521': (521 + 7) / 8 * 2 +} + SHAS = { 'sha256': SHA256, 'sha384': SHA384, @@ -86,24 +94,17 @@ class Entry_pre_load(Entry_collection): if self.key_path is None: self.key_path = '' - def _CreateHeader(self): - """Create a pre load header""" - hash_name, sign_name = self.algo_name.split(',') - padding_name = self.padding_name - key_name = os.path.join(self.key_path, self.key_name) - + def _CreateHeaderRsa(self, hash_name, sign_name, padding_name, key_name): # Check hash and signature name/type if hash_name not in SHAS: self.Raise(hash_name + " is not supported") - if sign_name not in RSAS: - self.Raise(sign_name + " is not supported") # Read the key key = RSA.import_key(tools.read_file(key_name)) # Check if the key has the expected size if key.size_in_bytes() != RSAS[sign_name]: - self.Raise("The key " + self.key_name + " don't have the expected size") + self.Raise("The key " + self.key_name + " doesn't have the expected size") # Compute the hash hash_image = SHAS[hash_name].new() @@ -151,6 +152,65 @@ class Entry_pre_load(Entry_collection): return data + pad + def _CreateHeaderEcdsa(self, hash_name, sign_name, key_name): + # Check hash and signature name/type + if hash_name not in SHAS: + self.Raise(hash_name + " is not supported") + + # Read the key + key = ECC.import_key(tools.read_file(key_name)) + + # Check if the key has the expected size + if key.pointQ.size_in_bytes() * 2 != ECDSAS[sign_name]: + self.Raise("The key " + self.key_name + " doesn't have the expected size") + + # Compute the hash + hash_image = SHAS[hash_name].new() + hash_image.update(self.image) + + # Compute the signature + signer = DSS.new(key, 'fips-186-3') + sig = signer.sign(hash_image) + + hash_sig = SHA256.new() + hash_sig.update(sig) + + version = self.version + header_size = self.header_size + image_size = len(self.image) + ofs_img_sig = 64 + len(sig) + flags = 0 + reserved0 = 0 + reserved1 = 0 + + first_header = struct.pack('>4sIIIIIII32s', PRE_LOAD_MAGIC, + version, header_size, image_size, + ofs_img_sig, flags, reserved0, + reserved1, hash_sig.digest()) + + hash_first_header = SHAS[hash_name].new() + hash_first_header.update(first_header) + sig_first_header = signer.sign(hash_first_header) + + data = first_header + sig_first_header + sig + pad = bytearray(self.header_size - len(data)) + + return data + pad + + def _CreateHeader(self): + """Create a pre load header""" + hash_name, sign_name = self.algo_name.split(',') + padding_name = self.padding_name + key_name = os.path.join(self.key_path, self.key_name) + + if sign_name in RSAS: + return self._CreateHeaderRsa(hash_name, sign_name, padding_name, key_name) + + if sign_name in ECDSAS: + return self._CreateHeaderEcdsa(hash_name, sign_name, key_name) + + self.Raise(sign_name + " is not supported") + def ObtainContents(self): """Create a placeholder for the header""" self.SetContents(tools.get_bytes(0, self.header_size)) diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py index 5f0de4c74a7..a3209bb1595 100644 --- a/tools/binman/ftest.py +++ b/tools/binman/ftest.py @@ -5925,12 +5925,62 @@ fdt fdtmap Extract the devicetree blob from the fdtmap image_fname = tools.get_output_filename('image.bin') is_signed = self._CheckPreload(image_fname, self.TestFile("dev.key")) + self.assertEqual(PRE_LOAD_MAGIC, data[:len(PRE_LOAD_MAGIC)]) + self.assertEqual(PRE_LOAD_VERSION, data[4:4 + len(PRE_LOAD_VERSION)]) + self.assertEqual(PRE_LOAD_HDR_SIZE, data[8:8 + len(PRE_LOAD_HDR_SIZE)]) + self.assertEqual(is_signed, True) + def testPreLoadEcdsa(self): + """Test an image with a pre-load header using ecdsa key""" + entry_args = { + 'pre-load-key-path': os.path.join(self._binman_dir, 'test'), + } + data = self._DoReadFileDtb( + 'security/pre_load_ecdsa.dts', entry_args=entry_args, + extra_indirs=[os.path.join(self._binman_dir, 'test')])[0] + + image_fname = tools.get_output_filename('image.bin') + is_signed = self._CheckPreload(image_fname, + self.TestFile('ecdsa521.pem'), + 'sha256,ecdsa521') self.assertEqual(PRE_LOAD_MAGIC, data[:len(PRE_LOAD_MAGIC)]) self.assertEqual(PRE_LOAD_VERSION, data[4:4 + len(PRE_LOAD_VERSION)]) self.assertEqual(PRE_LOAD_HDR_SIZE, data[8:8 + len(PRE_LOAD_HDR_SIZE)]) self.assertEqual(is_signed, True) + def testPreLoadEcdsaInvalidSha(self): + """Test an image with a pre-load ecdsa header with an invalid hash""" + entry_args = { + 'pre-load-key-path': os.path.join(self._binman_dir, 'test'), + } + with self.assertRaises(ValueError) as exc: + self._DoReadFileDtb('security/pre_load_ecdsa_invalid_sha.dts', + entry_args=entry_args) + self.assertIn("Node '/binman/pre-load': sha2560 is not supported", + str(exc.exception)) + + def testPreLoadEcdsaInvalidAlgo(self): + """Test an image with a pre-load header with an invalid algo""" + entry_args = { + 'pre-load-key-path': os.path.join(self._binman_dir, 'test'), + } + with self.assertRaises(ValueError) as exc: + data = self._DoReadFileDtb('security/pre_load_ecdsa_invalid_algo.dts', + entry_args=entry_args) + self.assertIn("Node '/binman/pre-load': ecdsa5210 is not supported", + str(exc.exception)) + + def testPreLoadEcdsaInvalidKey(self): + """Test an image with a pre-load header with an invalid key size""" + entry_args = { + 'pre-load-key-path': os.path.join(self._binman_dir, 'test'), + } + with self.assertRaises(ValueError) as exc: + data = self._DoReadFileDtb('security/pre_load_ecdsa_invalid_key.dts', + entry_args=entry_args) + self.assertIn("Node '/binman/pre-load': The key ecdsa521.pem doesn't have the expected size", + str(exc.exception)) + def _CheckSafeUniqueNames(self, *images): """Check all entries of given images for unsafe unique names""" for image in images: diff --git a/tools/binman/test/ecdsa521.pem b/tools/binman/test/ecdsa521.pem new file mode 100644 index 00000000000..ac1904d3955 --- /dev/null +++ b/tools/binman/test/ecdsa521.pem @@ -0,0 +1,7 @@ +-----BEGIN EC PRIVATE KEY----- +MIHcAgEBBEIBM+CNnraGci2/mw1wPq44l2HccHnoBbdP3DiU6zqsBOq8IR8uegz2 +FLzWsjxcW7hwROCdEm6tW99wqsyPE25RZ3egBwYFK4EEACOhgYkDgYYABABu5bWV +aQ4EgnXFjojX9df3gBEBipphEEFAoG87GuoWBdlimFC8UEEXiKNU37w0wlJn4bG0 +8uOKwDqBk3uF+DrmZwB45lCSKkjdRWsJeDt+iEuFe2O/mbXoL4p5D8MM2OsDV5GT +srUbxhXq+T/i5lV7XXm2+tT/7zU8ZQce6WRufbd9KQ== +-----END EC PRIVATE KEY----- diff --git a/tools/binman/test/security/pre_load_ecdsa.dts b/tools/binman/test/security/pre_load_ecdsa.dts new file mode 100644 index 00000000000..247b85aad4c --- /dev/null +++ b/tools/binman/test/security/pre_load_ecdsa.dts @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + pre-load { + content = <&image>; + algo-name = "sha256,ecdsa521"; + key-name = "ecdsa521.pem"; + header-size = <4096>; + version = <0x11223344>; + }; + + image: blob-ext { + filename = "refcode.bin"; + }; + }; +}; diff --git a/tools/binman/test/security/pre_load_ecdsa_invalid_algo.dts b/tools/binman/test/security/pre_load_ecdsa_invalid_algo.dts new file mode 100644 index 00000000000..be71edbbdcd --- /dev/null +++ b/tools/binman/test/security/pre_load_ecdsa_invalid_algo.dts @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + pre-load { + content = <&image>; + algo-name = "sha256,ecdsa5210"; + key-name = "ecdsa521.pem"; + header-size = <4096>; + version = <0x11223344>; + }; + + image: blob-ext { + filename = "refcode.bin"; + }; + }; +}; diff --git a/tools/binman/test/security/pre_load_ecdsa_invalid_key.dts b/tools/binman/test/security/pre_load_ecdsa_invalid_key.dts new file mode 100644 index 00000000000..15d71cf0324 --- /dev/null +++ b/tools/binman/test/security/pre_load_ecdsa_invalid_key.dts @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + pre-load { + content = <&image>; + algo-name = "sha256,ecdsa384"; + key-name = "ecdsa521.pem"; + header-size = <4096>; + version = <0x11223344>; + }; + + image: blob-ext { + filename = "refcode.bin"; + }; + }; +}; diff --git a/tools/binman/test/security/pre_load_ecdsa_invalid_sha.dts b/tools/binman/test/security/pre_load_ecdsa_invalid_sha.dts new file mode 100644 index 00000000000..1017707375e --- /dev/null +++ b/tools/binman/test/security/pre_load_ecdsa_invalid_sha.dts @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + pre-load { + content = <&image>; + algo-name = "sha2560,ecdsa521"; + key-name = "ecdsa521.pem"; + header-size = <4096>; + version = <0x11223344>; + }; + + image: blob-ext { + filename = "refcode.bin"; + }; + }; +}; From patchwork Tue Sep 1 15:48:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296096 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=HON/Uqr7; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=blkJGlQT; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9Kn5ts2z1xwZ for ; Wed, 02 Sep 2026 01:50:05 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 75ED5607EE; Tue, 1 Sep 2026 15:50:04 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id wdrhRX30SXew; Tue, 1 Sep 2026 15:50:01 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277794; bh=BJoVPykgyU95lNOsohc8UczZKGo40zeKV5onL9l4SHQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=HON/Uqr7WtWziPLOKzXo3h5lH2ZG9QkwUMIn8KfYMqcz5heNzANz4BNeaKzjekW0m W/WsZ2VxeITFtPS70B3XDb4q10zBg9/7831h2jD+DGefbKSvGXrC1V9X8dGyrco0hx mjmbrDMProrF+Ols9DTLrsMXAtNqglwkTjVwQR76TkM6n0ZcvoBbzdTVA7IcH7iNYd GnnvhdDpKSE3eVAuTs/i88GbCdJlKDlv4kqpjdJNRHDEIuqalasU2XYAhMCD0c5Zy1 eywW9kr5ur+tsmQbGTk52eDsxWB+XknkmFxV2tSBHL8K3XXzDzhkmdF3TvcVeCu9rK cjCWLQp8vpTlQ== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id F0DEF607FE; Tue, 1 Sep 2026 15:49:53 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists1.osuosl.org (Postfix) with ESMTP id 523C9279 for ; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 443B740737 for ; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id mqseETqogJts for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp4.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp4.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=blkJGlQT Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp4.osuosl.org (Postfix) with ESMTPS id 055EF4070F for ; Tue, 1 Sep 2026 15:49:31 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 148948484C; Tue, 1 Sep 2026 17:49:23 +0200 (CEST) Received: from MRZP264CU002.outbound.protection.outlook.com (mail-francesouthazlp170100001.outbound.protection.outlook.com [IPv6:2a01:111:f403:c207::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id DF9B38467F for ; Tue, 1 Sep 2026 17:48:58 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="blkJGlQT"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=zLfHs8Pc/SXLCp3vnBBNK+ZJG2kyK7mZQ2K2P1RIm2rrKv7veiQ3jGUwXeSdSwcMGEv/YYbuP5LcbBmYi3uYfEirePuft+c6Y7vseAv9WTU3s5+DgQFjJyYqK3+MHkO4tBlA3Om5EuYhQorJzCoYHxrupxW64EF+4whJ/J5I11MiQ/Fq40y6eJx9GGF8UYRg5CBpo3zacpo+3a17iPMWqVHyVFeG4x8BxTVQL4crJvfnZ1lz6UszimzsLZV9s6Hzs100K4ml9RHUCbor6L40RhhFO4G9vvvVnZoHJ7ZVfFe/tAb5ZHA9F8QE4TIhlXSZnKQXd7rAZh8ayO5/ilG9ow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BJoVPykgyU95lNOsohc8UczZKGo40zeKV5onL9l4SHQ=; b=fNfJtszOaejYaAPc+akVv5GbbE9oLpjpRM8dbkL2wOOkV8AO6iww0tURMXIMifxKJ02YWMI3SR6SdguNwHgADBjufTlf+XPHnpgj6TUzIMDELZgY87ZJugJj3OMppNDcjLIM+IqLR/70HScSpHO7sOBiqCHvByQRyWucZYiWAzzGio1h7FFsyPCoCtzv2Lb7Oql8ieOhClgeLA9AkA9FJF/SsCNTglHbdhd1PGxwKM4cu52pgaX3JWcv3hn6xU+cJyi/sIrdDtbLS1FW6AcJEV2ZWCm8qQrpzjmlAY37IP2CsJJaot5hdP51XNW2YIZSiGpbQKz7GveXYyhA0E+EQQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BJoVPykgyU95lNOsohc8UczZKGo40zeKV5onL9l4SHQ=; b=blkJGlQTbLEgw415bSM2LHK1VCI3YeOQssCFFs5HLZbtCPX+3IlzOVWu55uzwzgLmiLjV+JRrTd+Bw0opjlXK7yyISPVIMxfSj3vBkP2ZmBm0QGHwUMY/4/EqjX99K7bh9nUvzD+/e4zkBDKKwsi2j1lm+P2Rcb8mZyOhWhqVjO/bmzugYVUfosmKTlIVoSjg9mDTUQLdLRGfIxrWJCuZU5FWWACtuXdQLfD7UkuZvtLz1ugOkfNF7k5yGRrXe4a7x5ICEwmaS7zcksGDmbpoIPJ6Po+9mQdtuqR6qdBH+cch0D5g/afgeyVvrrn+y2GF/+RQFjDmDmABKR8amnThA== Received: from PAZP264CA0070.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1fd::13) by MR0P264MB7216.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:a9::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA2PEPF00019230.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1fd:cafe::7c) by PAZP264CA0070.outlook.office365.com (2603:10a6:102:1fd::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA2PEPF00019230.mail.protection.outlook.com (10.167.242.36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 3787C2044F; Tue, 1 Sep 2026 17:48:53 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 12/15] boot: pre-load: add support of ecdsa Date: Tue, 1 Sep 2026 17:48:41 +0200 Message-ID: <20260901154845.102123-13-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA2PEPF00019230:EE_|MR0P264MB7216:EE_ X-MS-Office365-Filtering-Correlation-Id: cc1dd091-bae8-4fc8-dd5b-08df08408650 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|82310400026|376014|23010399003|36860700016|18002099003|22082099003|56012099006|10067099003; X-Microsoft-Antispam-Message-Info: SQbKYvHRoDou/PphnH+1SDFjBxJqS6f1oFFAQ2wxRK7pk3CrojJpVXnbHUSg1aPTjqVAZmyJSNDexwjVEqafmcS4dQEjKoOyeqKAJS7J9Kwb3ou/6CiQBmNUVo+OitNsc6VVc936xvx2SJNMQSbcXtJyuVLLaGb9oKBsOiSd14roDYgM1FXxhYk2xmXxdJDrUdMyZoQy3S8yb2xZcAecdt/OndxrVdKxwQNm7S/7FCf3HsbSFHLj3Ba6lVcRKMlF2Osy59LDWSHONAt9Ok8A2j9S2WRhSZsc2kgHJ4ckaoraEmZ3xYKlKX5gMwugf36AHQ+Y8M35vAtZgLPk9CFWeKEz9+qz7EVIiQTgA7JbcSoZVgv0HCphEyZctoDNXGdYd66rjGO6uimLmb5AwGaMf6N9mNHElyrB8CmQrwZn9dC8DbP36Bflii6VSMkkwcuWzkGC7oSuhr6/WUwgd5QhGCL2RLXaSkekGf4YYl120sgT0sZr9sm3p3go8/VM89DS7PRLIIAt+IX5FYvqIVP+PW0mpmibdYwgJ4XaiU0KZiefJYU1sB//gHvW0s/sHAOmZJab125PNwESscDyckaPoaN84A1Gyx9I5hiRnhcBvRyK66Ccw/Kj4DmqT19u7rUtWNOJK4k9UCDT9s9qE9y9b79D1gJwt3KkLIZC+ugDOoqrfghQnBtAVhWbhhUIKTVa6IJIRqNkocODYtBfENYdZA== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(82310400026)(376014)(23010399003)(36860700016)(18002099003)(22082099003)(56012099006)(10067099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: qMqH1Y1VaUcK+PavFoiS69LgJ9Ldin5neJzBz36RB49gKReWC1c+B9GLPx5WQZgJ7vxf2jtobwO1Qa915DUowlNyQWwW6PbGhlRPgpADxLlhMYSGhfQjWuAi3I2ALTPhzsjXAbe5ULLY7hNUO3MjBOcfc52Go0o10E1UzvMaqeGhJPMmfGO/nTUEcG44ic30p8MGkwh0Uoclf0iLrkdLTvbVmKOp07UFor70sK8Wbw38oJyHpMgbLleLPckxdkyYbWOgVEhZAveMtaUC68Nv35AjeJypB0J0WACE0+3qAIsFvPVAeK/5ubclLxYfKuRLgi4W6IjoSB5QaGl5UtUFYI5VfOd8GX9EZwaptW+bZmlcLTp9uB/Har/+INPMgqESbAZQ7tgvlo4WgzLogSo1/aWiipzAMnAFL6A1Wr/28Qj3sdqm6MGmlL/DMji4cl0q X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:53.3794 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: cc1dd091-bae8-4fc8-dd5b-08df08408650 X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA2PEPF00019230.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MR0P264MB7216 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Right now, u-boot can only boot image with a pre-load header with rsa. We add the support of ecdsa. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v3: - initial version v4: - avoid calling image_get_crypto_algo several times v5: - simplify the function is_ecdsa - re-use already computed crypto in function image_pre_load_sig_setup v6: - no change v7: - no change v8: - no change v9: - no change boot/image-pre-load.c | 53 +++++++++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 12 deletions(-) diff --git a/boot/image-pre-load.c b/boot/image-pre-load.c index 2f851ebb28c..af72ea6d547 100644 --- a/boot/image-pre-load.c +++ b/boot/image-pre-load.c @@ -70,6 +70,12 @@ static int image_pre_load_sig_setup(struct image_sig_info *info) return 0; } #else + +static int is_ecdsa(struct crypto_algo *crypto) +{ + return crypto && !strncmp(crypto->name, "ecdsa", 5); +} + /* * This function gathers information about the signature check * that could be done before launching the image. @@ -86,6 +92,7 @@ static int image_pre_load_sig_setup(struct image_sig_info *info) int key_len; int node, ret = 0; char *sig_info_path = NULL; + struct crypto_algo *crypto; if (!info) { log_err("ERROR: info is NULL for image pre-load sig check\n"); @@ -114,11 +121,24 @@ static int image_pre_load_sig_setup(struct image_sig_info *info) goto out; } - padding_name = fdt_getprop(gd_fdt_blob(), node, - IMAGE_PRE_LOAD_PROP_PADDING_NAME, NULL); - if (!padding_name) { - log_info("INFO: no padding_name provided, so using pkcs-1.5\n"); - padding_name = "pkcs-1.5"; + crypto = image_get_crypto_algo(algo_name); + if (!crypto) { + printf("ERROR: can't find a valid crypto algo from %s\n", + (char *)algo_name); + ret = -EINVAL; + goto out; + } + + if (is_ecdsa(crypto)) { + padding_name = NULL; + } else { + padding_name = fdt_getprop(gd_fdt_blob(), node, + IMAGE_PRE_LOAD_PROP_PADDING_NAME, + NULL); + if (!padding_name) { + log_info("INFO: no padding_name provided, so using pkcs-1.5\n"); + padding_name = "pkcs-1.5"; + } } sig_size = fdt_getprop(gd_fdt_blob(), node, @@ -129,12 +149,17 @@ static int image_pre_load_sig_setup(struct image_sig_info *info) goto out; } - key = fdt_getprop(gd_fdt_blob(), node, - IMAGE_PRE_LOAD_PROP_PUBLIC_KEY, &key_len); - if (!key) { - log_err("ERROR: no key for image pre-load sig check\n"); - ret = -EINVAL; - goto out; + if (is_ecdsa(crypto)) { + key = NULL; + key_len = 0; + } else { + key = fdt_getprop(gd_fdt_blob(), node, + IMAGE_PRE_LOAD_PROP_PUBLIC_KEY, &key_len); + if (!key) { + log_err("ERROR: no key for image pre-load sig check\n"); + ret = -EINVAL; + goto out; + } } info->algo_name = (char *)algo_name; @@ -152,9 +177,13 @@ static int image_pre_load_sig_setup(struct image_sig_info *info) info->sig_info.name = info->algo_name; info->sig_info.padding = image_get_padding_algo(info->padding_name); info->sig_info.checksum = image_get_checksum_algo(info->sig_info.name); - info->sig_info.crypto = image_get_crypto_algo(info->sig_info.name); + info->sig_info.crypto = crypto; info->sig_info.key = info->key; info->sig_info.keylen = info->key_len; + if (is_ecdsa(crypto)) { + info->sig_info.required_keynode = node; + info->sig_info.fdt_blob = gd_fdt_blob(); + } out: return ret; From patchwork Tue Sep 1 15:48:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296082 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=bzKLavB1; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=v0W8gyC5; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KD216Sz1xwZ for ; Wed, 02 Sep 2026 01:49:36 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id B1A7A6079D; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id xkLaWuyjoGSa; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277770; bh=YzDnEXJ3LlBP11/pfno7hvH5oS5DZZJuwOGheVXgpdk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=bzKLavB1XoVyE0cds382KEWAxHhKk6tGso99b1OZ8YH4edUMlnR2RwJcjso/y2lKO eW8i355weCkt7hE4Hbo0AkxyuELKiXQPE98cUmRfuVZnZQh4HPTUYozV45vcxZvdV6 aYTP7C0HOCyfyAWfpJJKw4dgYKRSkQ0JEfRQOiVAVE1XI+qj1JRnDafmRqsjGQdgfG AMrb7j0NHKEC7mghiQA3kSoVoXYCJ1uNLKhRNCQq0W7pi83XTUDE6bEpkgwZ7XjdbI vqCpu8MjwGvXJxQoOYf8I3UrGahGR+DaN16BK5JBVwLfam9LRu+7xBvV9YanibrXnW RwbMds5Uy2L1g== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id 7BB2360782; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists1.osuosl.org (Postfix) with ESMTP id C20F8422 for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id BFF4380972 for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 5metKXG8cg6V for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp1.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp1.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=v0W8gyC5 Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp1.osuosl.org (Postfix) with ESMTPS id C685580D86 for ; Tue, 1 Sep 2026 15:49:28 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 27AE184A29; Tue, 1 Sep 2026 17:49:18 +0200 (CEST) Received: from PA5P264CU001.outbound.protection.outlook.com (mail-francecentralazlp170100000.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E06918484C for ; Tue, 1 Sep 2026 17:48:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="v0W8gyC5"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AwFzqa+U+g1TR75b5BkIi/SbTRcBmtPBn3McZ8oTsGh4MbG+21e27TegtE819sNOMy4uimTTfLbAq2E7Q2fRSAvukoshVU/JQBKu+mw1OINo/fXOT+Rl5GmRAyh07/cHyC/mMaXz8CSpm6DGP1C9zxuH8pAPT7VOy1mOYchPg+m5XsRER3rI2fWD975Ju/BoTlxdmHQ24xYSAgTh2llbtHsFeNv8icc16Uy32vTN+EQd4NYX5w5BvasTmjWvvJ/lCrFmfG3LYHtM4ipq5Bhjm8KmdYiGnzUeVMlrte5eeWCzDkWYPSKPLQnPy5v8dKuUwtR2+EN53pF6354OZTRhIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=YzDnEXJ3LlBP11/pfno7hvH5oS5DZZJuwOGheVXgpdk=; b=rAN8ebzI1jfFwRi2O9iVkcNYyjVrtYqoeie1cOC1EGXzUp2kRNUyf6GjPxDzTCuHAznFGh/2vtG2H4DUKFvJWTAoqz54ZqKGYcm7V1Bm0eOqQVSTebb2NWhH5d95JZz5grqADo+KJWA6xaqxo+ob+kgEaysdvjBFIolzp9H9Hvnwf96lSr56zE5XPUwzRayte5e6G+ZsKm2Ct8S2c1qDY4vG5Ksv7YeaC603ZnpM3EB+jbdErMdot9gGEtX1SepGWbbiw5nVUfRP0yk6UgmZnuGvSAM7gjyu5pzLTzwkADeNqknZcq8iQOn36fuXBCfD5BHvD4/aezuddG5irfCjmA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YzDnEXJ3LlBP11/pfno7hvH5oS5DZZJuwOGheVXgpdk=; b=v0W8gyC5zUX94ry+10GSYzqFgfc1RfEbqJdhz7T7s8t8+sRECC1A8iRqF+REKEHZyQvyEidApTYG3xhXsm8j5hpKGYcew3+VgpqLMhJyd8KJ/J1r2k+2A6qO1GxLwbRQl/flnATHK2TxeJj+1vLK8s1+ZvMxV5dd2r2jmZbo2nKGJpXv9a6kOjr+/bpHHxHdKOIpfdomKWqDLHYuH0adNhGQjKjU1cZofV+bvCsVTxYRZQDV8dGr+SUuW+D/JwUYqqIffwmuKaUXG+IIUGRkdZV79jEnfbOmHbeQU1pt3JNBj686yAshYvvz9kRtGpPIc88zqwlqcRDaaputWgHeSQ== Received: from PAZP264CA0133.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1f8::19) by MR0P264MB7803.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:a6::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA2PEPF00019231.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1f8:cafe::2) by PAZP264CA0133.outlook.office365.com (2603:10a6:102:1f8::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA2PEPF00019231.mail.protection.outlook.com (10.167.242.37) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 4E3EB209C3; Tue, 1 Sep 2026 17:48:53 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 13/15] tools: preload_check_sign: add support of ecdsa Date: Tue, 1 Sep 2026 17:48:42 +0200 Message-ID: <20260901154845.102123-14-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA2PEPF00019231:EE_|MR0P264MB7803:EE_ X-MS-Office365-Filtering-Correlation-Id: ec0d06ab-bcd1-49cb-90cd-08df0840865d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|376014|36860700016|23010399003|82310400026|10067099003|56012099006|22082099003|18002099003|6133799003; X-Microsoft-Antispam-Message-Info: FcZfIPX3CtIciKQ9kH4MEnX0gnBmPPeXCqIgMqjsmv7r3je6j+DRFDzfp4TA4qScwUC4m4Wjisu1YRaAMPCsG1oG2zONHw+0EXE3OtaISP+MWJw3lbjxKyZGLXIjphElV10O8LDlWg0FZid5AwVMS1j46gDXEGnrpdkPyudqk1Mwm8dBkp9PQ3CgpmGnVYeG7xOUyEuX6cRSsV4FpYNrMNRErbQdfjfFByh2ZcN/7cYq2JmLuqS8PTcKRdt1pyjYcKAHczQ2ELR3mi3UshRupNWWnBWzPXG8S3p7UQ9ON0TljwsXtcMM7hv7HPx0ydefrb04uroQelPJMJ/ZtR+1cMFzg+gBtYXWy797syyv/HS68dXC3NQJ6aPinT/OvRwtNRRXIC72OZ5Pu4Vtsr0p1dLZ4uNxiMy+MnlWYz8RUiPiU1KGoebPPA2DlFeglVD1Ak5o2CpYFqezZBtGGGU1Sms69WXovqW1N1BTCjYhs7eh8JUW2AHSh8THfMd5vJivG2f6g1YUK0BnllbQSYhDZErFq8VddytqMCPDzPNk+9fX+peFvJ4swdqIcne4Glac8aZ6tVKfoDhmUyegF9kDHcUrnSZWZEMPDib+YBbEuwAdUSRGmi+O8Yu0Zi4uJzxXkr6AuFHDRO/b6z92qjbaVNkjOgFixzgrJBwDlwPaeJETswJ+xiDC97+G1ZP+cQONymk8gsVhU2IFFs+EFJCiug== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(376014)(36860700016)(23010399003)(82310400026)(10067099003)(56012099006)(22082099003)(18002099003)(6133799003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: TClkK3tceuytfBpgvVfC/GwCAQz4qOKQ4NGVIOX+vEfZVwOMctkjS3tRPiHN3wI3C8/JMk7ONoRMjGgRmqq5q2w3B3MISylo4B0LJEpEh+f81gyvdXEJ1F7tN6D4r5DqO+OUtjVHbyGUdIoGHTe0S9w5Js5nP3yHSgDxctr2QitQN2wtgw3TgjDGY8J3pIPFT41/dB/OFxVN9PsK8y+2gDd5y6ph0lP8wsQ6ZDnUHlTFKbEuBpPf8WsMwIs2cthnS7RhON4jH0E189loMv8v7F9g9cdleyceHoX4I7CHGox+eDurMkvmvgK1UPEgsishmMj1kCxPSfbJmQPvR484i1nsTTuIjI7m7BXHnJv4UvglzNPPBpnXzqHulJMQH4j0JZblDazUbHB/MSymPTKU4JTe8vSUy4InFUbg1X3KzeyMd8DlfzDt5iMc7VWn8Ytx X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:53.4651 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ec0d06ab-bcd1-49cb-90cd-08df0840865d X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA2PEPF00019231.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MR0P264MB7803 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org right now, the tool preload_check_sign may only checks an image with a pre-load header with rsa. We add the support of pre-load header with ecdsa. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v3: - initial version v4: - free key to avoid mem leak - fix error management (set ret before goto out) v5: - add include ec.h, evp.h, err.h and image.h v6: - no change v7: - no change v8: - no change v9: - no change tools/preload_check_sign.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/tools/preload_check_sign.c b/tools/preload_check_sign.c index ebead459273..d94f0509e74 100644 --- a/tools/preload_check_sign.c +++ b/tools/preload_check_sign.c @@ -8,9 +8,13 @@ * complete file. The tool preload_check_sign allows to verify and authenticate * a file starting with a preload header. */ + +#define OPENSSL_API_COMPAT 0x10101000L + #include #include #include +#include #include #include #include @@ -144,6 +148,32 @@ int main(int argc, char **argv) info.sig_info.key = info.key; info.sig_info.keylen = info.key_len; + /* For ecdsa key, we have to update some values */ + if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) { + EC_KEY *ecdsa_key; + const EC_GROUP *group; + + ecdsa_key = EVP_PKEY_get1_EC_KEY(pkey); + if (!ecdsa_key) { + fprintf(stderr, "Can not extract ECDSA key\n"); + ret = EXIT_FAILURE; + goto out; + } + + group = EC_KEY_get0_group(ecdsa_key); + if (!group) { + fprintf(stderr, "Can not extract ECDSA group\n"); + EC_KEY_free(ecdsa_key); + ret = EXIT_FAILURE; + goto out; + } + + info.sig_info.keyfile = keyfile; + info.sig_size = (EC_GROUP_order_bits(group) + 7) / 8 * 2; + + EC_KEY_free(ecdsa_key); + } + /* Check the signature */ image_pre_load_sig_set_info(&info); ret = image_pre_load_sig((ulong)buffer); From patchwork Tue Sep 1 15:48:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296083 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=SWUlEWNm; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=Us8JAc6D; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KF1JClz1xwg for ; Wed, 02 Sep 2026 01:49:37 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id BDABD80972; Tue, 1 Sep 2026 15:49:35 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id H9opFihsX7vi; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277774; bh=HZXYxpDqlMS+kJfxORrYV2+iK/OnLUluxRaUCtMpNE0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=SWUlEWNmGFOIzNrRS7xe85ZMuXf18IE5KSkg04osKQR0tvL2EemKhbnDlClbgHAkW u15jHRKtrT8kxtMq/mBwss0XDxelCtEDEoaL/f9dYbD2BO8nb2UzATEdtbdOMvGZqF ee2qCYLleww1SlqeZkP/BTMQfQor+DqBHw1yDVg85HbxLt+AD6JfgQOpIwik1L66Db zYeVPzb05PHJq0x00WLIWTaHw7N6gcVXaoxdfqnqBnwFfqP0Gc8u4qNON7icVrviyj DPL6myyl9sqIk29w1xQGjIGtTVgl8Ghe9DHztmuSXaezchQFt8yZSXgcx1wXiq+0kR OPxHXi85KSMzg== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id C75DA80D73; Tue, 1 Sep 2026 15:49:34 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists1.osuosl.org (Postfix) with ESMTP id EF7C11D9 for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id E9EA56076B for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Ux5FHaQl1gGY for ; Tue, 1 Sep 2026 15:49:29 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp3.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=Us8JAc6D Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) by smtp3.osuosl.org (Postfix) with ESMTPS id D94C16078D for ; Tue, 1 Sep 2026 15:49:28 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 0D81584A4A; Tue, 1 Sep 2026 17:49:23 +0200 (CEST) Received: from MRZP264CU002.outbound.protection.outlook.com (mail-francesouthazlp170100001.outbound.protection.outlook.com [IPv6:2a01:111:f403:c207::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id E434A849A1 for ; Tue, 1 Sep 2026 17:48:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="Us8JAc6D"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=u6qKmkYz/wAxnknDX2Wwvos7VYAaoWWM1RumSdU/LESQls1SoD9eQ/KHL2F2NaJ73tWft6VtBatOS/7s2XcXQfCMHGFWo2AyG89LMv2DzBhWcH4rkDxFIx6YVpbiSE5o9hSJgPWvUPTikQXqkesZs+rlxT+z1O5CUyRGQeW/fT6hpBnPpFfjQjTv/YoRA8+mawigCUsCRntqdkcRBPiQQNgvY08B131fBqT6pCRMSM9BsZhVoJuTwpYyHMinF4CXgAg7w+zXM6JcsPjm/bB9pIIkUxOs/UOo61Qv3rQjE4/SeNHy1C2y72SmHYSI9aW3sGqBvAdMbIw2oZOFs+zE4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HZXYxpDqlMS+kJfxORrYV2+iK/OnLUluxRaUCtMpNE0=; b=CGcyzJZMzX+SLYJTaaB1kCLAle7GQtR0BCN1v9z1HFruVoGt5j/HDsegMOxDRNmU5oBPGG19ZgH+b2Dfh41oVztWMHolRjI8nD/Z6HXBQjGDFoljUbRWDKdqozKTs18UZhPzqeNzQ0nfUXB/DimA0uSLy4IFfXYOkgE2cREFJz5Wjz/UDpsrWTtaLXN4Deg3Pq8EsfdqUF2BwdCggRj1WnH3WTGp9s+koPKGmTmTYeaHbF5BcURbM3C7RcfE+CijUycUibiRjFza7+yUItFbxt8ffowr5c6O5xE5cMkB0mo79dF7KaipHACIn12Vb6JHNaForVP/09Akd2I3JWfAcg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HZXYxpDqlMS+kJfxORrYV2+iK/OnLUluxRaUCtMpNE0=; b=Us8JAc6D0Jh5D9O+ebnk7MDue0p+z91WAUWPLfG4+jI0dn6sOsaFZ3zlRBiprByDg10WyN69sBejxH4Yu/m1LeRCGDFQSDUSYHtBvXYkgrCSLFrAmvCrDktK+raxU7RH4U7sLAP8DLMJbscoVpPw8wFEzA10G06CE5RdYNpKVqKaluOrEPnTVkbjf+aNGF86PyY02lqd+srLEu7pcCjf15rkW3oVe7MCxsclHXMt0odXWx0A0ONiLyNG9fcrHZ7elFBzzD7wtXGrRxM++Rx8A9hP9eLBfhTL3uRjrNzRtR5HBt6eyQmsIP5bQb/BG0C/34RpnDs5C4wSFY6Y3nhfbA== Received: from PAZP264CA0110.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1ef::14) by PR1P264MB3431.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:182::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA2PEPF00019232.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:1ef:cafe::58) by PAZP264CA0110.outlook.office365.com (2603:10a6:102:1ef::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA2PEPF00019232.mail.protection.outlook.com (10.167.242.38) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 68810202C3; Tue, 1 Sep 2026 17:48:53 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 14/15] test: py: vboot: prepare test for global signature with ecdsa Date: Tue, 1 Sep 2026 17:48:43 +0200 Message-ID: <20260901154845.102123-15-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA2PEPF00019232:EE_|PR1P264MB3431:EE_ X-MS-Office365-Filtering-Correlation-Id: a1cca0ac-f02b-4490-fd2e-08df0840866a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|376014|23010399003|82310400026|36860700016|56012099006|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: ecsN48sfoGCtC9RP77BsLPmgMNcSUafn+gvXaZoBSApZq2y6QKeHU0GczUemG3p+EIVHW2gNkH5mNJrL4H5pJJ/LGFHt6zR6w2O7rNrfAHx7ui7ch6P+/V0HzsfB+YCzat9C/MPsZEKV7upTjbBoSkGoeqj9RpeOKDpClI/EA3E1HF5dwOT6ABjEFXHKbkuxmeGQGEDtDF6yHWE7PTVUGXe/wjYhSrSjTiabypekSHaMkw7eD/z96Nc0Dsuxm34wOdtrNTHHtFK/lhObKLbTqP7XNgkYRPGKNQ7AeOEN1nHRyxTa+OuqZX3UZS/axLnY2KATL+N1ii0gVj7Pr41Q8VcGPsRiC7RWLrNNX5n+n35URTwPojWbvRzTHA6FNxyHQi2Q9N5KhNaEvbi1hnQQT8JgN/Gv4yDZfAxTA2OAqjUDWJu8KVXu9jnfm5y2AoZkWxQ4UbOAZeO5zOZr9GZLLTa35GMhJFvkU4r5tUck0LP0NiTWxyw1DREFowu63dXMlA6ZjMA8ZLLzpZjHGW0CREl4ADJNSEdTTagVOLe/EP+vmECGGhmu68Br5DX1+pdOQCv5V9j+p7bpFfNLyZpj99oARk8u3q1tSFCpVAvyoMWO+bMwDk5LeTo++f0MtZe4cUoMJr0dGR2gBVMSBE9Hz14zF3LpUbIellaR6MoIYnkJomuDSpy2aTIWI6SZAhhfKLlNdhJdahlk5JRcDdCKow== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(1800799024)(376014)(23010399003)(82310400026)(36860700016)(56012099006)(10067099003)(18002099003)(22082099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: lskLqLEL+K0WW+pPZZWFQlacBhxSzqQWUE5r+QxV/zb/zUotJ4H4rlhZA0BZkuGh8f4+iFjplDQXKRWTWRUKnZJNT+H5CUxh9OzccX1jBCtesAUjUFVJ6cuF81NNl6T3VtzUPSjNoUhHFWb7LSH4DX4SFy1aafiTzqhSAeezHp0EX5gcKFo610vNGYuZWx05ec24T2gWlqjbj2D4Hcyn4Pfulnwu0VMRgOhoi+Vfeq9jh9JkIXkbOpcVTwLbPmtJHe73gicVvWWzWpi+3F/lusIc5S/gQmYUcrHLrfTjZyfPim2OLl72FsQZ9rH+yM9KMo9j2wcIe8GqbLIoYYQ+bT0LQYOfLF6rHZhQSS9ORl3UvT5xmqzhGKNprq7vqiKBNdCO6znQNL06HqOJJ1roqke069QeokmTRseaNhWtbcuytnUjE5wN0+BtYOriMAW6 X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:53.5512 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a1cca0ac-f02b-4490-fd2e-08df0840866a X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA2PEPF00019232.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR1P264MB3431 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org The vboot tests only consider rsa for test with global signature. To prepare the integration of test with ecdsa test, the signature algo is now explicit. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v3: - initial version v4: - no change v5: - no change v6: - no change v7: - no change v8: - no change v9: - no change test/py/tests/test_vboot.py | 12 ++++++------ ...binman-pss.dts => sandbox-binman-rsa2048-pss.dts} | 0 ...sandbox-binman.dts => sandbox-binman-rsa2048.dts} | 0 ...pss.dts => sandbox-u-boot-global-rsa2048-pss.dts} | 0 ...-global.dts => sandbox-u-boot-global-rsa2048.dts} | 0 5 files changed, 6 insertions(+), 6 deletions(-) rename test/py/tests/vboot/{sandbox-binman-pss.dts => sandbox-binman-rsa2048-pss.dts} (100%) rename test/py/tests/vboot/{sandbox-binman.dts => sandbox-binman-rsa2048.dts} (100%) rename test/py/tests/vboot/{sandbox-u-boot-global-pss.dts => sandbox-u-boot-global-rsa2048-pss.dts} (100%) rename test/py/tests/vboot/{sandbox-u-boot-global.dts => sandbox-u-boot-global-rsa2048.dts} (100%) diff --git a/test/py/tests/test_vboot.py b/test/py/tests/test_vboot.py index 89876ff030a..e3996486ab6 100644 --- a/test/py/tests/test_vboot.py +++ b/test/py/tests/test_vboot.py @@ -536,7 +536,7 @@ def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required, dtb) run_bootm(sha_algo, 'multi required key', '', False) - def test_global_sign(sha_algo, padding, sign_options): + def test_global_sign(sha_algo, sig_algo, padding, sign_options): """Test global image signature with the given hash algorithm and padding. Args: @@ -545,14 +545,14 @@ def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required, rsa signature algorithm. """ - dtb = '%ssandbox-u-boot-global%s.dtb' % (tmpdir, padding) + dtb = '%ssandbox-u-boot-global%s%s.dtb' % (tmpdir, sig_algo, padding) ubman.config.dtb = dtb # Compile our device tree files for kernel and U-Boot. These are # regenerated here since mkimage will modify them (by adding a # public key) below. dtc('sandbox-kernel.dts', ubman, dtc_args, datadir, tmpdir, dtb) - dtc_options('sandbox-u-boot-global%s.dts' % padding, '-p 1024') + dtc_options('sandbox-u-boot-global%s%s.dts' % (sig_algo, padding), '-p 1024') # Build the FIT with dev key (keys NOT required). This adds the # signature into sandbox-u-boot.dtb, NOT marked 'required'. @@ -561,11 +561,11 @@ def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required, # Build the dtb for binman that define the pre-load header # with the global sigature. - dtc('sandbox-binman%s.dts' % padding, ubman, dtc_args, datadir, tmpdir, dtb) + dtc('sandbox-binman%s%s.dts' % (sig_algo, padding), ubman, dtc_args, datadir, tmpdir, dtb) # Run binman to create the final image with the not signed fit # and the pre-load header that contains the global signature. - run_binman('sandbox-binman%s.dtb' % padding) + run_binman('sandbox-binman%s%s.dtb' % (sig_algo, padding)) # Check that the signature is correctly verified by u-boot run_bootm(sha_algo, 'global image signature', @@ -615,7 +615,7 @@ def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required, try: ubman.config.dtb = dtb if global_sign: - test_global_sign(sha_algo, padding, sign_options) + test_global_sign(sha_algo, sig_algo, padding, sign_options) elif required: test_required_key(sha_algo, sig_algo, padding, sign_options) else: diff --git a/test/py/tests/vboot/sandbox-binman-pss.dts b/test/py/tests/vboot/sandbox-binman-rsa2048-pss.dts similarity index 100% rename from test/py/tests/vboot/sandbox-binman-pss.dts rename to test/py/tests/vboot/sandbox-binman-rsa2048-pss.dts diff --git a/test/py/tests/vboot/sandbox-binman.dts b/test/py/tests/vboot/sandbox-binman-rsa2048.dts similarity index 100% rename from test/py/tests/vboot/sandbox-binman.dts rename to test/py/tests/vboot/sandbox-binman-rsa2048.dts diff --git a/test/py/tests/vboot/sandbox-u-boot-global-pss.dts b/test/py/tests/vboot/sandbox-u-boot-global-rsa2048-pss.dts similarity index 100% rename from test/py/tests/vboot/sandbox-u-boot-global-pss.dts rename to test/py/tests/vboot/sandbox-u-boot-global-rsa2048-pss.dts diff --git a/test/py/tests/vboot/sandbox-u-boot-global.dts b/test/py/tests/vboot/sandbox-u-boot-global-rsa2048.dts similarity index 100% rename from test/py/tests/vboot/sandbox-u-boot-global.dts rename to test/py/tests/vboot/sandbox-u-boot-global-rsa2048.dts From patchwork Tue Sep 1 15:48:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Philippe Reynes X-Patchwork-Id: 2296089 X-Patchwork-Delegate: raymondmaoca@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=suCEHvKT; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=txN0O5jq; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ9KR6rn1z1xwg for ; Wed, 02 Sep 2026 01:49:47 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 93A5080E0C; Tue, 1 Sep 2026 15:49:46 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id jUWDJkIX0GO9; Tue, 1 Sep 2026 15:49:45 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788277785; bh=+DEpTs6DpqQEhQg+cqJ+Ni+Y9xk+TO3BLDrZ6WNU3+4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=suCEHvKTjpBMyxS0QGeXKvUdxin1Hl5YNOrfwPlRtXXn+esjJIWmbv/YNrS4tdXYo x0poXuGbdr6Jl/m4vR2Yq40ckp9Z3HZiuWlhss6zau+fyYsQSostTRyZmhUTKWHXoX 5z6Z/WPJEtO5djEymzIGyDwUzzV/2zSvm9JI613fVRTcEAwnlFF6/l9WeaYJeA1eme JDnf7E0hRyRiuxx2EGg/UYjV1ttvljUxh2xoX8eQTqTVK+KJ6KH9P476U7rFGrxu9R vptq17qpH4j2nRzX0hRj8aI4pzmEbStxqARcvDzP69yOOmRNsnCMWa8fgMtc8BFvHX cGKMuCQFyKDnA== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id 8937380E05; Tue, 1 Sep 2026 15:49:45 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists1.osuosl.org (Postfix) with ESMTP id 11D20422 for ; Tue, 1 Sep 2026 15:49:33 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id E6191607A2 for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id n69V7rKYnNDS for ; Tue, 1 Sep 2026 15:49:32 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=philippe.reynes@softathome.com; receiver= Authentication-Results: smtp3.osuosl.org; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com header.b=txN0O5jq Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) by smtp3.osuosl.org (Postfix) with ESMTPS id 3CB9C6078C for ; Tue, 1 Sep 2026 15:49:30 +0000 (UTC) Received: by phobos.denx.de (Postfix, from userid 109) id 1A5258404D; Tue, 1 Sep 2026 17:49:26 +0200 (CEST) Received: from PR0P264CU014.outbound.protection.outlook.com (mail-francecentralazlp170120004.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20a::4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id D7947841F2 for ; Tue, 1 Sep 2026 17:49:03 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=softathome.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=philippe.reynes@softathome.com Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com header.b="txN0O5jq"; dkim-atps=neutral ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=JQJeMWqbdghu3Vu4ci3Ynr0OT5fqGhBhYYy4899Gn2lLjPIAA9mV6aTabBvRkiqPPbwjHFpz3cmGmwWEj9MRpy5yq6kwa9niILMsovkjsWauZHAs2SjOsTbpD9W48EGCkm0vNnNfEPqBSG/iAyHWL/pTPAXXDsCelI0gSoB9luTPqn9/OIlYppT/CFztqNsccmq/yMXPuwK8IdrK4ZQ1xuXevUOZjQbYXXPIH8YF8NwDULpce7sZqzEbT1exQ22CPDgWLIVaeJopQ3G7nrtBGjzpNjFSaU6ezlIK+v3v0x7GOMVFpdYNsnzUoZQNzTrZQDz324rkgL6/PnoHc6ld7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+DEpTs6DpqQEhQg+cqJ+Ni+Y9xk+TO3BLDrZ6WNU3+4=; b=BL58GLuognAXpDHIEIUDFoBrXEy2Ad6vCmEVrAOLprFwNOlsbrJA4DenBDxCvo26Jljx5Br8eiYDnQN7EYwNhJPjqHFQBZ6eyi/wBgI3oINs4aNviKKi6qplixHQo7EQsItTJCpA6NM2pWMwNBbb2mXsAfbixHUYgVmfOlCw3RHV9K5SdqP+Q8wI5BqthdyzN351xZgSkZkfn6eOZWJLwSQyR+cM8qSDN7BFa3Efm03sd9ZfwHWvv97kDU992P7TTnlYxZm5NATv/K/3GHdIfVQCtP/k4FJDe5OTipts3kEtHmdXTkDWxePeXEGQSgDJH6dU0W0C1oReqrTNKrzo7w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com; dmarc=bestguesspass action=none header.from=softathome.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+DEpTs6DpqQEhQg+cqJ+Ni+Y9xk+TO3BLDrZ6WNU3+4=; b=txN0O5jqP0tfGVgBefNkvaIWgLPV0BwDBCK9nrJzIy9I2NhDaue4wxen1kvSWc1haxQ5OtN0BQaL4W4dioms5Cjsi60wFqJY78KMZcKO5RXrTHoAzfm78cAK5PbGZmFVvKcxPpvtTBzR3yHv7oSbwARrItwxHu8pg3w1oXEQJ8f2SG/MpMR8JUYhJL4bufwPnkQ4XBb4wz+NqB501KFcR+URcXqHadfEgw+I7bXNJ9TOlqc4Lxp36yj9tViNd8NmyJfFiFztTfooU2B7BT208GwTCOETlnu4bXJTDcUNOCmjVUu/nh67SN3ZhwdvdGZB14BPomCmFP5eL52gQ+9SLA== Received: from PR3P195CA0026.EURP195.PROD.OUTLOOK.COM (2603:10a6:102:b6::31) by PAPP264MB7613.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:547::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Tue, 1 Sep 2026 15:48:53 +0000 Received: from PA1PEPF000CC3F9.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:b6:cafe::3a) by PR3P195CA0026.outlook.office365.com (2603:10a6:102:b6::31) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 149.6.166.170) smtp.mailfrom=softathome.com; dkim=none (message not signed) header.d=none;dmarc=bestguesspass action=none header.from=softathome.com; Received-SPF: Pass (protection.outlook.com: domain of softathome.com designates 149.6.166.170 as permitted sender) receiver=protection.outlook.com; client-ip=149.6.166.170; helo=proxy.softathome.com; pr=C Received: from proxy.softathome.com (149.6.166.170) by PA1PEPF000CC3F9.mail.protection.outlook.com (10.167.242.4) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Tue, 1 Sep 2026 15:48:53 +0000 Received: from sah1lpt726.softathome.com (unknown [192.168.72.32]) by proxy.softathome.com (Postfix) with ESMTPSA id 7E82D1FEAF; Tue, 1 Sep 2026 17:48:53 +0200 (CEST) From: Philippe Reynes To: marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com, trini@konsulko.com, simon.glass@canonical.com Cc: u-boot@lists.denx.de, Philippe Reynes , Simon Glass Subject: [PATCH v9 15/15] test: py: vboot: add test for global signature with ecdsa Date: Tue, 1 Sep 2026 17:48:44 +0200 Message-ID: <20260901154845.102123-16-philippe.reynes@softathome.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260901154845.102123-1-philippe.reynes@softathome.com> References: <20260901154845.102123-1-philippe.reynes@softathome.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PA1PEPF000CC3F9:EE_|PAPP264MB7613:EE_ X-MS-Office365-Filtering-Correlation-Id: dd2913eb-4ce3-40e1-095a-08df0840867b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|36860700016|1800799024|82310400026|23010399003|376014|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: E/k/GJxsDAJF8J4JilWvgxTyBdgMMWht7oH90etJCYaR+IjWoMVhGW5jFtjuzUd36tvAnJlUCcwBw7eDnvpjpQOYL/SOi4AOThFotvU3oGA+CfDBSHxHAMOZ14Ff8eMhryWhCd6EUfXr1BrRidBPoYEqZwjEOew+w6DAYpOCkAYpWDhOYKbPl3wvzTNCZaIrLxicwxbPcYOYS6GXQ3e+jfKjgkQdzMKrjvYshj0kJkFzxi8PNa6+Q+BP61nix51zIBP01JA64TjSXBsycDZf9XGSF8XFxZqYZhsi3TUt0PEqxbg2F8vTAuo6hTcLiUTy3eoqXZpm+hprUAc7zMTW8fjks56vBq/7uVEAmuuDGaBs6XoNYyOT+lpieFFiMjo6uxiw/yLgP+P2WnjQCTiWzVtQss+rJ9ont6qlCy4t8TYIZ124hszpuIYC5oZ5zZKgXHa8U/SC+3Ztz3JZlySOcpcG29vhRkLwgszM4dxA43vI9elLXxFbPrNaOxYm3zLR6+Egb+fSlcrFK5OG7ks9TI+vVNG4GoN64YcoIIzeuHrFLw+v4SBhUOyf8fNgel+JcuNh7ij2w8disM0f0UUnFN2nC8hsL3AZU3Y8YGInwgoo03llSNCi800/V7tVF936F/oezykkAJWIWqrh0CaY8lRknWCioKnnSE0hR3j3+5S/wC4my2/kcQSAB95Im03J8+rAjTWwGGoGwUe0xAIx7A== X-Forefront-Antispam-Report: CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230040)(36860700016)(1800799024)(82310400026)(23010399003)(376014)(10067099003)(56012099006)(22082099003)(18002099003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: j4ktBtLeQzMJeUxqhu/UIAQ17mfpHwNL0IwA8ROw76ZegrTHtqMMY5GjvQZ7djI2almKmrzdUq/s6FmVtv87wgns/a9j6RsLtE/x5nItJQVLSeaB8fVbilctA2FGEbgKwERSjq2XG4MDjcIaOjxLBtPnMwcht/lSF759jryaTAErIUz/rir/v685fUXEjsHfBxHbZUcpHPTe3qy92+6OvYscUcOfZ5C8LurSRUZ2OVmiNL9cVrDzZwfYNVgZhbjy2RotMFL694lRyEfE71CM8mbvjEnFd2v3FGlLDBgjjrKTqlEq3+ZQcntEdhJ8SC31rqND+GO701GnzhyrNMF2dUxFCbJmkKFb1We79ByxCNoBIz8ZcZsDkkGicVNuBe+DcoJWcyUlDtfRbSJDbURdKzpfqRJbVkCbY/Mk2fM1ITkoEMKsMi8CeCFz0auGc6S9 X-OriginatorOrg: softathome.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Sep 2026 15:48:53.6543 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: dd2913eb-4ce3-40e1-095a-08df0840867b X-MS-Exchange-CrossTenant-Id: aa10e044-e405-4c10-8353-36b4d0cce511 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170]; Helo=[proxy.softathome.com] X-MS-Exchange-CrossTenant-AuthSource: PA1PEPF000CC3F9.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAPP264MB7613 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org As now u-boot supports pre-load header with ecdsa, we add some tests to vboot with ecdsa pre-load header. Reviewed-by: Simon Glass Reviewed-by: Raymond Mao Signed-off-by: Philippe Reynes --- v3: - initial version v4: - no change v5: - no change v6: - no change v7: - no change v8: - no change v9: - no change test/py/tests/test_vboot.py | 3 +++ .../tests/vboot/sandbox-binman-ecdsa256.dts | 24 +++++++++++++++++ .../tests/vboot/sandbox-binman-ecdsa384.dts | 24 +++++++++++++++++ .../tests/vboot/sandbox-binman-ecdsa521.dts | 24 +++++++++++++++++ .../vboot/sandbox-u-boot-global-ecdsa256.dts | 27 +++++++++++++++++++ .../vboot/sandbox-u-boot-global-ecdsa384.dts | 27 +++++++++++++++++++ .../vboot/sandbox-u-boot-global-ecdsa521.dts | 27 +++++++++++++++++++ 7 files changed, 156 insertions(+) create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa256.dts create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa384.dts create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa521.dts create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa256.dts create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa384.dts create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa521.dts diff --git a/test/py/tests/test_vboot.py b/test/py/tests/test_vboot.py index e3996486ab6..ed7e6bb33d2 100644 --- a/test/py/tests/test_vboot.py +++ b/test/py/tests/test_vboot.py @@ -102,6 +102,9 @@ TESTDATA_IN = [ ['algo-arg', 'algo-arg', '', '', '-o sha256,rsa2048', False, False, True, False], ['sha256-global-sign', 'sha256', '-rsa2048', '', '', False, False, False, True], ['sha256-global-sign-pss', 'sha256', '-rsa2048', '-pss', '', False, False, False, True], + ['sha256-global-sign-ecdsa256', 'sha256', '-ecdsa256', '', '', False, False, False, True], + ['sha256-global-sign-ecdsa384', 'sha256', '-ecdsa384', '', '', False, False, False, True], + ['sha256-global-sign-ecdsa521', 'sha256', '-ecdsa521', '', '', False, False, False, True], ] # Mark all but the first test as slow, so they are not run with '-k not slow' diff --git a/test/py/tests/vboot/sandbox-binman-ecdsa256.dts b/test/py/tests/vboot/sandbox-binman-ecdsa256.dts new file mode 100644 index 00000000000..0e84b81078b --- /dev/null +++ b/test/py/tests/vboot/sandbox-binman-ecdsa256.dts @@ -0,0 +1,24 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + filename = "sandbox.img"; + + pre-load { + content = <&image>; + algo-name = "sha256,ecdsa256"; + key-name = "dev.pem"; + header-size = <4096>; + version = <1>; + }; + + image: blob-ext { + filename = "test.fit"; + }; + }; +}; diff --git a/test/py/tests/vboot/sandbox-binman-ecdsa384.dts b/test/py/tests/vboot/sandbox-binman-ecdsa384.dts new file mode 100644 index 00000000000..56faf67fe57 --- /dev/null +++ b/test/py/tests/vboot/sandbox-binman-ecdsa384.dts @@ -0,0 +1,24 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + filename = "sandbox.img"; + + pre-load { + content = <&image>; + algo-name = "sha256,ecdsa384"; + key-name = "dev.pem"; + header-size = <4096>; + version = <1>; + }; + + image: blob-ext { + filename = "test.fit"; + }; + }; +}; diff --git a/test/py/tests/vboot/sandbox-binman-ecdsa521.dts b/test/py/tests/vboot/sandbox-binman-ecdsa521.dts new file mode 100644 index 00000000000..8e2fc3de31d --- /dev/null +++ b/test/py/tests/vboot/sandbox-binman-ecdsa521.dts @@ -0,0 +1,24 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + filename = "sandbox.img"; + + pre-load { + content = <&image>; + algo-name = "sha256,ecdsa521"; + key-name = "dev.pem"; + header-size = <4096>; + version = <1>; + }; + + image: blob-ext { + filename = "test.fit"; + }; + }; +}; diff --git a/test/py/tests/vboot/sandbox-u-boot-global-ecdsa256.dts b/test/py/tests/vboot/sandbox-u-boot-global-ecdsa256.dts new file mode 100644 index 00000000000..f15ada3987c --- /dev/null +++ b/test/py/tests/vboot/sandbox-u-boot-global-ecdsa256.dts @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + model = "Sandbox Verified Boot Test"; + compatible = "sandbox"; + + binman { + }; + + reset@0 { + compatible = "sandbox,reset"; + }; + + image { + pre-load { + sig { + algo-name = "sha256,ecdsa256"; + signature-size = <64>; + mandatory = "yes"; + + key-name = "dev"; + }; + }; + }; +}; diff --git a/test/py/tests/vboot/sandbox-u-boot-global-ecdsa384.dts b/test/py/tests/vboot/sandbox-u-boot-global-ecdsa384.dts new file mode 100644 index 00000000000..24540ace249 --- /dev/null +++ b/test/py/tests/vboot/sandbox-u-boot-global-ecdsa384.dts @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + model = "Sandbox Verified Boot Test"; + compatible = "sandbox"; + + binman { + }; + + reset@0 { + compatible = "sandbox,reset"; + }; + + image { + pre-load { + sig { + algo-name = "sha256,ecdsa384"; + signature-size = <96>; + mandatory = "yes"; + + key-name = "dev"; + }; + }; + }; +}; diff --git a/test/py/tests/vboot/sandbox-u-boot-global-ecdsa521.dts b/test/py/tests/vboot/sandbox-u-boot-global-ecdsa521.dts new file mode 100644 index 00000000000..72fa3b2c790 --- /dev/null +++ b/test/py/tests/vboot/sandbox-u-boot-global-ecdsa521.dts @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + model = "Sandbox Verified Boot Test"; + compatible = "sandbox"; + + binman { + }; + + reset@0 { + compatible = "sandbox,reset"; + }; + + image { + pre-load { + sig { + algo-name = "sha256,ecdsa521"; + signature-size = <132>; + mandatory = "yes"; + + key-name = "dev"; + }; + }; + }; +};